fix(logging): detach preflight stderr handler when scan logging starts

fix(packaging): bundle certifi CA bundle in PyInstaller binary
Standalone macOS builds failed LLM preflight with a generic Connection error because cacert.pem was missing from the frozen bundle; also surface STRIX_DEBUG logs and exception cause chains before scan logging starts. Fixes #1008
2026-08-16 17:27:26 +02:00 · 2026-08-07 17:14:43 +00:00 · 2026-08-07 15:46:29 +02:00 · 2026-08-07 06:14:22 -07:00 · 2026-08-06 23:22:06 -07:00 · 2026-08-06 22:03:57 +03:00
320 changed files with 52255 additions and 6968 deletions
@@ -6,6 +6,9 @@ on:
      - 'v*'
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  build:
    strategy:
@@ -14,30 +17,69 @@ jobs:
        include:
          - os: macos-latest
            target: macos-arm64
+            wheel-platform: macosx_11_0_arm64
          - os: macos-15-intel
            target: macos-x86_64
+            wheel-platform: macosx_11_0_x86_64
          - os: ubuntu-22.04
            target: linux-x86_64
+            wheel-platform: manylinux_2_17_x86_64
+          - os: ubuntu-22.04-arm
+            target: linux-arm64
+            wheel-platform: manylinux_2_17_aarch64
          - os: windows-latest
            target: windows-x86_64
+            wheel-platform: win_amd64

    runs-on: ${{ matrix.os }}

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false

-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
        with:
          python-version: '3.12'

-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version: '1.24.x'
+          check-latest: true
+          cache-dependency-path: strix/interface/tui/go.sum

      - name: Build
        shell: bash
+        env:
+          STRIX_WHEEL_PLATFORM_TAG: ${{ matrix.wheel-platform }}
        run: |
          uv sync --frozen
+          uv build --wheel
+          uv run python -c 'import glob, os, sys, zipfile; wheels = glob.glob("dist/*.whl"); assert len(wheels) == 1, wheels; archive = zipfile.ZipFile(wheels[0]); tui = "strix/bin/strix-tui.exe" if sys.platform == "win32" else "strix/bin/strix-tui"; assert tui in archive.namelist(); metadata = archive.read(next(name for name in archive.namelist() if name.endswith(".dist-info/WHEEL"))).decode(); assert "Root-Is-Purelib: false" in metadata; assert "Tag: py3-none-" + os.environ["STRIX_WHEEL_PLATFORM_TAG"] in metadata'
+
          uv run pyinstaller strix.spec --noconfirm

+          if [[ "${{ runner.os }}" == "Windows" ]]; then
+            PYI_BINARY="dist/strix.exe"
+            TUI_NAME="strix-tui.exe"
+            dist/strix.exe --version
+          else
+            PYI_BINARY="dist/strix"
+            TUI_NAME="strix-tui"
+            dist/strix --version
+          fi
+          uv run pyi-archive_viewer -l "$PYI_BINARY" | grep -E "strix[/\\]+bin[/\\]+$TUI_NAME" >/dev/null
+
+          if [[ "${{ matrix.target }}" == "linux-arm64" ]]; then
+            file dist/strix
+            file dist/strix | grep -q "ARM aarch64" || {
+              echo "::error::linux-arm64 artifact is not an ARM aarch64 binary"
+              exit 1
+            }
+          fi
+
          VERSION=$(grep '^version' pyproject.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
          mkdir -p dist/release

@@ -50,12 +92,13 @@ jobs:
            tar -C dist/release -czvf "dist/release/strix-${VERSION}-${{ matrix.target }}.tar.gz" "strix-${VERSION}-${{ matrix.target }}"
          fi

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: strix-${{ matrix.target }}
          path: |
            dist/release/*.tar.gz
            dist/release/*.zip
+            dist/*.whl
          if-no-files-found: error

  release:
@@ -65,14 +108,14 @@ jobs:
      contents: write

    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
        with:
          path: release
          merge-multiple: true

      - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
        with:
          prerelease: ${{ !startsWith(github.ref, 'refs/tags/') }}
          generate_release_notes: true
-          files: release/*
+          files: release/**
@@ -1,17 +1,25 @@
+# Node / local-viewer SPA source (the built bundle in
+# strix/interface/viewer/static/ is committed and shipped; do not ignore it)
+node_modules/
+strix/interface/viewer/frontend/node_modules/
+strix/interface/viewer/frontend/.vite/
+
 # Python
 __pycache__/
 *.py[cod]
 *$py.class
 *.so
 .Python
-build/
+# Anchored to the repo root: these are Python build-artifact dir names, but
+# unanchored they also match nested source dirs (e.g. the viewer's src/lib).
+/build/
 develop-eggs/
 dist/
 downloads/
 eggs/
 .eggs/
-lib/
-lib64/
+/lib/
+/lib64/
 parts/
 sdist/
 var/
@@ -46,7 +54,7 @@ pip-delete-this-directory.txt
 .env.production.local

 # MongoDB
-data/
+/data/
 mongod.log
 *.mongodb
 *.mongorc.js
@@ -85,3 +93,8 @@ Thumbs.db
 schema.graphql

 .opencode/
+
+# Root-only local data and reference checkouts
+/.benchmarks/
+/references/
+/strix_runs_main/
@@ -20,7 +20,8 @@ repos:
          pydantic,
          fastapi,
          pytest,
-          "openai-agents[litellm]==0.14.6",
+          hatchling,
+          "openai-agents[litellm]>=0.19.0,<0.20",
        ]
        args: [--install-types, --non-interactive]

@@ -0,0 +1,49 @@
+# Strix — Agent Guide
+
+Strix is an open-source autonomous AI pentesting tool. This file is for AI coding agents that want to **use** Strix (run security scans) or **contribute** to it.
+
+## Using Strix from an agent
+
+Install the agent skills for step-by-step workflows:
+
+```bash
+npx skills add usestrix/strix
+```
+
+- `strix-pentest` — run a headless pentest against code, URLs, domains, or IPs and read results (covers both run modes below)
+- `strix-cloud-api` — drive the managed app.strix.ai platform via REST (no local Docker/LLM needed)
+- `strix-fix-findings` — remediate findings and re-run Strix to verify
+- `strix-ci-setup` — add PR scanning to CI/CD (self-hosted CLI or managed app)
+
+**Two ways to run, same engine — pick per situation:**
+
+- **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.
+  ```bash
+  curl -sSL https://strix.ai/install | bash        # install
+  export STRIX_LLM="openai/gpt-5.4"                 # any LiteLLM model id
+  export LLM_API_KEY="<key>"
+  strix -n -t ./ --scan-mode quick --max-budget 10  # headless scan; always use -n
+  ```
+  - Requires Docker running. Scans take minutes (`quick`) to hours (`deep`) — run in the background.
+  - Exit codes (headless): `0` clean, `1` fatal error, `2` vulnerabilities found. A `0` only covers what was analyzed — check `run.json` (`status`, `llm_usage.cost` vs the budget) before calling a run clean.
+  - Artifacts in `strix_runs/<run-name>/`: `penetration_test_report.md`, `vulnerabilities/*.md`, `vulnerabilities.json`, `findings.sarif` (SARIF 2.1.0), `run.json`.
+
+- **Managed cloud (app.strix.ai):** no Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Use it when local infra isn't available.
+  ```bash
+  # token from Settings → API Access; register the target as an asset, then:
+  curl -sS https://app.strix.ai/api/v1/scans -H "Authorization: Bearer $STRIX_API_TOKEN" \
+    -H "Content-Type: application/json" -d '{"engagement_type":"live_test","domain_ids":["<uuid>"]}'
+  ```
+  - API docs: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json).
+
+- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt).
+- Only scan targets the user is authorized to test.
+
+## Contributing to this repo
+
+- Python 3.12+, managed with `uv`. Install dev deps: `make dev-install`.
+- Lint/format/type-check/security, all in one: `make check-all` (ruff, mypy, bandit).
+- Tests: `uv run pytest`.
+- Run from source: `uv run strix --target <target>`.
+- Layout: `strix/agents` (agent graph + prompts), `strix/tools` (proxy, browser, terminal, scanners), `strix/runtime` (Docker sandbox), `strix/report` (findings, SARIF), `strix/skills` (internal knowledge packs the pentest agents load — different from the consumer skills in `skills/`), `strix/interface` (CLI/TUI), `containers/` (sandbox image).
+- Pre-commit hooks: `make pre-commit` (or `uv run pre-commit install`).
@@ -7,6 +7,7 @@ Thank you for your interest in contributing to Strix! This guide will help you g
 ### Prerequisites

 - Python 3.12+
+- Latest Go 1.24.x patch (only for Bubble Tea TUI development and release artifacts)
 - Docker (running)
 - [uv](https://docs.astral.sh/uv/) (for dependency management)
 - Git
@@ -99,6 +100,36 @@ We welcome feature ideas! Please:
 - Consider implementation approach
 - Be open to discussion

+## 🖥️ Local viewer SPA
+
+`strix view` serves a prebuilt web UI whose source lives in
+`strix/interface/viewer/frontend/` (a Vite + React project) and whose built output is
+committed to `strix/interface/viewer/static/` and shipped in the package. End users never
+run a JS build. If you change anything under `strix/interface/viewer/frontend/`, rebuild
+and commit the output:
+
+```bash
+make viewer   # or: cd strix/interface/viewer/frontend && npm ci && npm run build
+```
+
+Commit both the source change and the regenerated `strix/interface/viewer/static/`.
+
+## Package builds
+
+Editable installs do not need Go; they run the TUI from source (`go run`).
+
+Wheels always bundle the matching Go sidecar and are platform-specific:
+
+```bash
+make wheel
+```
+
+The build hook (`scripts/tui_sidecar_hook.py`) compiles the sidecar, embeds it as
+`strix/bin/strix-tui`, and assigns the current platform tag. It requires Go
+1.24.x or newer and fails rather than producing a wheel without the sidecar.
+`scripts/build.sh` and `strix.spec` are likewise strict for frozen PyInstaller
+releases.
+
 ## 🤝 Community

 - **Discord**: [Join our community](https://discord.gg/strix-ai)
@@ -1,4 +1,6 @@
-.PHONY: help install dev-install format lint type-check security check-all clean pre-commit setup-dev dev
+.PHONY: help install dev-install format lint type-check security check-all clean pre-commit setup-dev dev viewer wheel tui-build tui-test tui-lint
+
+TUI_BINARY := build/sidecar/strix-tui$(if $(filter Windows_NT,$(OS)),.exe)

 help:
 	@echo "Available commands:"
@@ -15,7 +17,12 @@ help:
 	@echo ""
 	@echo "Development:"
 	@echo "  pre-commit    - Run pre-commit hooks on all files"
+	@echo "  viewer        - Rebuild the local-viewer SPA (commit the output)"
+	@echo "  wheel         - Build a platform wheel with the bundled Go sidecar"
 	@echo "  clean         - Clean up cache files and artifacts"
+	@echo "  tui-build     - Build the Bubble Tea TUI"
+	@echo "  tui-test      - Test the Bubble Tea TUI"
+	@echo "  tui-lint      - Vet and format-check the Bubble Tea TUI"

 install:
 	uv sync --no-dev
@@ -66,5 +73,23 @@ clean:
 	find . -name "*.pyc" -delete 2>/dev/null || true
 	@echo "✅ Cleanup complete!"

+viewer:
+	@echo "🖥️  Building the local-viewer SPA..."
+	cd strix/interface/viewer/frontend && npm ci && npm run build
+	@echo "✅ Viewer built to strix/interface/viewer/static/ (commit the changes)."
+
+wheel:
+	uv build --wheel
+
 dev: format lint type-check
 	@echo "✅ Development cycle complete!"
+
+tui-build:
+	mkdir -p build/sidecar
+	cd strix/interface/tui && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o ../../../$(TUI_BINARY) ./cmd/strix-tui
+
+tui-test:
+	cd strix/interface/tui && go test -race ./...
+
+tui-lint:
+	cd strix/interface/tui && test -z "$$(gofmt -l .)" && go vet ./...
@@ -27,8 +27,8 @@
 <a href="https://x.com/strix_ai"><img src="https://github.com/usestrix/.github/raw/main/imgs/X.png" height="40" alt="Follow on X"></a>


-<a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>
 <a href="https://trendshift.io/repositories/15362?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-15362" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/15362/weekly" alt="usestrix%2Fstrix | Trendshift" width="250" height="55"/></a>
+<a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>

 </div>

@@ -108,6 +108,18 @@ Try the Strix full-stack penetration testing platform at **[app.strix.ai](https:

 ---

+## 🤖 Use Strix from Your Coding Agent
+
+Strix is agent-ready. Give Claude Code, Cursor, Codex, or any [SKILL.md-compatible](https://agentskills.io) agent the ability to run pentests, fix findings, and set up CI scanning:
+
+```bash
+npx skills add usestrix/strix
+```
+
+This installs four skills: **strix-pentest** (run headless scans and read results), **strix-cloud-api** (drive the managed [app.strix.ai](https://app.strix.ai) platform via REST — no local Docker or LLM key), **strix-fix-findings** (remediate + re-scan to verify), and **strix-ci-setup** (PR scanning in CI). Agents can run Strix two ways with the same engine — the open-source CLI locally, or the managed cloud when there's no local infra — and read [`AGENTS.md`](AGENTS.md) for a quick reference, [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) for the CLI docs, and [docs.app.strix.ai](https://docs.app.strix.ai) for the API.
+
+---
+
 ## ✨ Features

 ### Agentic Pentesting Tools
@@ -145,6 +157,31 @@ Advanced multi-agent orchestration for comprehensive automated penetration testi

 ---

+## 🖥️ Local Web Viewer
+
+Every scan writes its results to disk as it runs. Bring them up in a local dashboard with a single command:
+
+```bash
+# Open the most recent run
+strix view
+
+# ...or open a specific run by name
+strix view my-run-name
+```
+
+`strix view` starts a lightweight local server (bound to `127.0.0.1` on a random port) and opens your browser to a private, tokened link. Nothing leaves your machine: the dashboard reads the run's files straight off disk, with no cloud account or upload required. The UI ships prebuilt with Strix, so there is no extra install and no JS build step.
+
+### What's in the dashboard
+
+- **Overview**: run status, target, and a severity breakdown of everything found so far.
+- **Vulnerabilities**: each validated finding with its severity, details, and reproduction steps.
+- **Agent graph**: a live map of the multi-agent team, showing which agent is doing what.
+- **Steering**: send instructions to a live scan from the browser to redirect the agents mid-run.
+- **History**: browse past runs on this machine and jump between them.
+- **Reports**: generate a shareable report and email it to yourself or your team.
+
+---
+
 ## Usage Examples

 ### Basic Usage
@@ -160,6 +197,28 @@ strix --target https://github.com/org/repo
 strix --target https://your-app.com
 ```

+### API Testing (OpenAPI / Swagger / Postman)
+
+Point Strix at an API contract and it tests every declared endpoint instead of
+having to discover them by crawling. Pair the spec with the live base URL so the
+agent knows where to send traffic:
+
+```bash
+# OpenAPI / Swagger file (.json / .yaml)
+strix --target ./openapi.yaml --target https://api.your-app.com
+
+# Postman collection export
+strix --target ./collection.postman_collection.json --target https://api.your-app.com
+
+# Postman collection pulled live by id (no manual export)
+export POSTMAN_API_KEY="PMAK-..."
+strix --target postman://<collection-uuid>
+
+# ...with a Postman environment to resolve {{baseUrl}} / token variables
+strix --target "postman://<collection-uuid>?env=<environment-uuid>"
+```
+
+
 ### Advanced Testing Scenarios

 ```bash
@@ -242,6 +301,20 @@ export STRIX_REASONING_EFFORT="high"  # control thinking effort (default: high,
 > [!NOTE]
 > Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.

+#### Sign in with a ChatGPT subscription
+
+Instead of a metered API key, you can run Strix on your ChatGPT Plus/Pro subscription:
+
+```bash
+strix auth login chatgpt      # sign in with your ChatGPT account
+
+export STRIX_LLM="chatgpt/gpt-5.4"   # chatgpt/<model> runs on the subscription
+strix --target ./app-directory
+
+strix auth status             # show the active sign-in
+strix auth logout             # forget the sign-in
+```
+
 **Recommended models for best results:**

 - [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4`
@@ -272,10 +345,11 @@ Have questions? Found a bug? Want to contribute? **[Join our Discord!](https://d

 ## Acknowledgements

-Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Textual](https://github.com/Textualize/textual). Huge thanks to their maintainers!
+Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Bubble Tea](https://github.com/charmbracelet/bubbletea). Huge thanks to their maintainers!


 > [!WARNING]
-> Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.
+> **Authorized use only.** Strix actively tests the targets you point it at, so only run it against systems you own or have **explicit, written permission** to test, and stay within the agreed scope. Unauthorized testing is illegal in most jurisdictions.
+> You alone are responsible for obtaining authorization and complying with the law. Strix is provided "as is" with no warranty or liability for misuse.

 </div>
@@ -1,3 +1,27 @@
+# ---------------------------------------------------------------------------
+# Builder stage: compile the Go tools here so the Go toolchain (~225MB) and the
+# module/build caches never reach the runtime image. The resulting binaries are
+# statically linked and copied into the final stage.
+# ---------------------------------------------------------------------------
+FROM kalilinux/kali-rolling:latest AS gobuilder
+
+RUN apt-get update && \
+    apt-get install -y kali-archive-keyring && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends golang-go git ca-certificates
+
+ENV GOBIN=/out/bin
+RUN mkdir -p /out/bin && \
+    go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
+    go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
+    go install -v github.com/projectdiscovery/cvemap/cmd/vulnx@latest && \
+    go install -v github.com/jaeles-project/gospider@latest && \
+    go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest && \
+    go install -v golang.org/x/vuln/cmd/govulncheck@latest
+
+# ---------------------------------------------------------------------------
+# Runtime stage
+# ---------------------------------------------------------------------------
 FROM kalilinux/kali-rolling:latest

 LABEL description="AI Agent Penetration Testing Environment with Comprehensive Automated Tools"
@@ -19,17 +43,18 @@ RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    wget curl git vim nano unzip tar \
    apt-transport-https ca-certificates gnupg lsb-release \
-    build-essential software-properties-common \
-    gcc libc6-dev pkg-config libpcap-dev libssl-dev \
-    python3 python3-pip python3-dev python3-venv python3-setuptools \
-    golang-go \
+    software-properties-common \
+    gcc libc6-dev \
+    python3 python3-pip python3-venv python3-setuptools \
    net-tools dnsutils whois \
+    file xxd \
    jq parallel ripgrep grep \
-    less man-db procps htop \
+    less procps htop \
    iproute2 iputils-ping netcat-traditional \
    nmap ncat ndiff \
    sqlmap nuclei subfinder naabu ffuf \
    nodejs npm pipx \
+    golang-go \
    libcap2-bin \
    gdb \
    libnss3-tools \
@@ -65,11 +90,8 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/b
 USER pentester
 WORKDIR /tmp

-RUN go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
-    go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
-    go install -v github.com/projectdiscovery/cvemap/cmd/vulnx@latest && \
-    go install -v github.com/jaeles-project/gospider@latest && \
-    go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest
+# Go tools are built in the gobuilder stage; copy the static binaries only.
+COPY --from=gobuilder --chown=pentester:pentester /out/bin/ /home/pentester/go/bin/

 RUN nuclei -update-templates

@@ -86,7 +108,10 @@ RUN npm install -g retire@latest && \
    npm install -g js-beautify@latest && \
    npm install -g @ast-grep/cli@latest && \
    npm install -g tree-sitter-cli@latest && \
-    npm install -g agent-browser@0.26.0
+    npm install -g agent-browser@0.26.0 && \
+    npm cache clean --force && \
+    # ast-grep ships two identical binaries (`ast-grep` and `sg`); dedupe (~52MB)
+    ln -sf ast-grep /home/pentester/.npm-global/lib/node_modules/@ast-grep/cli/sg

 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
 ENV AGENT_BROWSER_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
@@ -131,7 +156,14 @@ RUN git clone https://github.com/aravind0x7/JS-Snooper.git && \

 USER root

-RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
+# Install trufflehog into a pentester-owned dir on PATH so its runtime self-update
+# (which replaces the binary in place) succeeds: as non-root `pentester` it cannot
+# overwrite a root-owned binary under /usr/local/bin, which otherwise fails with
+# "cannot move binary" and aborts the scan. Pin the initial version for
+# reproducible builds; self-update then pulls fresh detectors at runtime.
+ARG TRUFFLEHOG_VERSION=3.95.9
+RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /home/pentester/.local/bin "v${TRUFFLEHOG_VERSION}" && \
+    chown -R pentester:pentester /home/pentester/.local
 RUN set -eux; \
    ARCH="$(uname -m)"; \
    case "$ARCH" in \
@@ -145,8 +177,6 @@ RUN set -eux; \
    install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks; \
    rm -f /tmp/gitleaks /tmp/gitleaks.tgz

-RUN apt-get update && apt-get install -y zaproxy
-
 RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

 RUN apt-get install -y wapiti
@@ -162,7 +192,12 @@ USER root

 RUN apt-get autoremove -y && \
    apt-get autoclean && \
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
+    # Purge non-English locales (~160MB)
+    find /usr/share/locale -mindepth 1 -maxdepth 1 -type d \
+        ! -name 'en' ! -name 'en_US' ! -name 'C' -exec rm -rf {} + && \
+    # Remove package documentation and man pages not needed at runtime (~95MB)
+    rm -rf /usr/share/doc/* /usr/share/doc-base/* /usr/share/man/*

 ENV PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:/app/.venv/bin:$PATH"
 ENV VIRTUAL_ENV="/app/.venv"
@@ -192,6 +227,8 @@ RUN mkdir -p /workspace && chown -R pentester:pentester /workspace /app
 USER pentester
 RUN python3 -m venv /app/.venv && \
    /app/.venv/bin/pip install --no-cache-dir caido-sdk-client && \
+    /app/.venv/bin/pip install --no-cache-dir \
+        requests httpx beautifulsoup4 lxml pyjwt cryptography && \
    /app/.venv/bin/pip install --no-cache-dir -r /home/pentester/tools/jwt_tool/requirements.txt && \
    printf '%s\n' \
        '#!/bin/bash' \
@@ -202,8 +239,13 @@ RUN python3 -m venv /app/.venv && \
 COPY --chown=pentester:pentester strix/tools/proxy/caido_api.py /opt/strix-python/caido_api.py
 ENV PYTHONPATH=/opt/strix-python

-RUN echo 'export PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:$PATH"' >> /home/pentester/.bashrc && \
-    echo 'export PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:$PATH"' >> /home/pentester/.profile
+# Login shells (e.g. `bash -lc`) source /etc/profile, which on Debian/Kali
+# hard-resets PATH and drops the image's ENV PATH entries. Re-add the same
+# directories here — including /app/.venv/bin — so `python3`/`pip` resolve to
+# the venv (which ships requests, httpx, bs4, lxml, pyjwt, cryptography, and the
+# Caido SDK) instead of the externally-managed system interpreter.
+RUN echo 'export PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:/app/.venv/bin:$PATH"' >> /home/pentester/.bashrc && \
+    echo 'export PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:/app/.venv/bin:$PATH"' >> /home/pentester/.profile

 USER root
 COPY containers/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
@@ -1,6 +1,22 @@
 #!/bin/bash
 set -e

+if [ -n "${STRIX_HOST_UID:-}" ] && [ "${STRIX_HOST_UID}" != "0" ] && [ "${STRIX_HOST_UID}" != "$(id -u)" ]; then
+  exec sudo -E -- bash -c '
+    set -e
+    gid="${STRIX_HOST_GID:-$STRIX_HOST_UID}"
+    old_uid="$1"
+    old_gid="$2"
+    export PATH="$3"
+    shift 3
+    sed -i "s|^pentester:x:${old_uid}:${old_gid}:|pentester:x:${STRIX_HOST_UID}:${gid}:|" /etc/passwd
+    sed -i "s|^pentester:x:${old_gid}:|pentester:x:${gid}:|" /etc/group
+    chown -R "${STRIX_HOST_UID}:${gid}" /home/pentester /app/certs
+    chown "${STRIX_HOST_UID}:${gid}" /workspace
+    exec setpriv --reuid "${STRIX_HOST_UID}" --regid "${gid}" --init-groups "$0" "$@"
+  ' "$0" "$(id -u)" "$(id -g)" "$PATH" "$@"
+fi
+
 CAIDO_PORT=48080
 CAIDO_LOG="/tmp/caido_startup.log"

@@ -91,10 +107,13 @@ http_proxy=http://127.0.0.1:${CAIDO_PORT}
 https_proxy=http://127.0.0.1:${CAIDO_PORT}
 EOF

-echo "source /etc/profile.d/proxy.sh" >> ~/.bashrc
-echo "source /etc/profile.d/proxy.sh" >> ~/.zshrc
+# Use POSIX `.` (not the bashism `source`) so these lines are safe when the rc
+# files are read by a POSIX shell (e.g. `sh -lc`), which otherwise fails with
+# "source: not found". `.` is understood by bash, zsh, and dash alike.
+echo ". /etc/profile.d/proxy.sh" >> ~/.bashrc
+echo ". /etc/profile.d/proxy.sh" >> ~/.zshrc

-source /etc/profile.d/proxy.sh
+. /etc/profile.d/proxy.sh

 echo "✅ System-wide proxy configuration complete"

@@ -19,6 +19,14 @@ Configure Strix using environment variables or a config file.
  Custom API base URL. Also accepts `OPENAI_API_BASE`, `LITELLM_BASE_URL`, or `OLLAMA_API_BASE`.
 </ParamField>

+<ParamField path="LLM_EXTRA_HEADERS" type="string">
+  Extra HTTP headers sent on every LLM request, as a JSON object (e.g.
+  `{"X-Feature-Key":"value","X-Tenant":"acme"}`). Useful for OpenAI-compatible
+  gateways that require attribution or routing headers in addition to the bearer
+  token. The bearer token itself still comes from `LLM_API_KEY`. Applies to both
+  the LiteLLM and native OpenAI routing paths.
+</ParamField>
+
 <ParamField path="LLM_TIMEOUT" default="300" type="integer">
  Request timeout in seconds for LLM calls.
 </ParamField>
@@ -28,19 +36,54 @@ Configure Strix using environment variables or a config file.
 </ParamField>

 <ParamField path="STRIX_REASONING_EFFORT" default="high" type="string">
-  Control thinking effort for reasoning models. Valid values: `none`, `minimal`, `low`, `medium`, `high`, `xhigh`. Defaults to `medium` for quick scan mode.
+  Control thinking effort for reasoning models. Valid values: `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`. Defaults to `medium` for quick scan mode.
 </ParamField>

 <ParamField path="STRIX_MEMORY_COMPRESSOR_TIMEOUT" default="30" type="integer">
  Timeout in seconds for memory compression operations (context summarization).
 </ParamField>

+### Dedicated deduplication model
+
+Finding deduplication is a cheap, structured classification task. By default it
+runs on the main model, but you can route it to a smaller/cheaper model without
+affecting the agents that do the actual testing.
+
+<ParamField path="STRIX_DEDUPE_MODEL" type="string">
+  Model used to judge whether a candidate finding duplicates an existing report.
+  Falls back to `STRIX_LLM` when unset.
+</ParamField>
+
+<ParamField path="DEDUPE_LLM_API_KEY" type="string">
+  Optional provider key for the deduplication model.
+</ParamField>
+
+<ParamField path="DEDUPE_LLM_API_BASE" type="string">
+  Optional custom API base URL for the deduplication model. Use when the dedupe
+  model runs on a different endpoint than the main model.
+</ParamField>
+
+<ParamField path="DEDUPE_LLM_EXTRA_HEADERS" type="string">
+  Optional JSON object of extra HTTP headers sent on every deduplication-model
+  request, e.g. `{"X-Feature-Key":"value"}`. A dedicated dedupe model never
+  inherits `LLM_EXTRA_HEADERS`; set this when its endpoint needs custom headers.
+</ParamField>
+
+<ParamField path="STRIX_DEDUPE_REASONING_EFFORT" type="string">
+  Reasoning effort for the deduplication model. Defaults to the model's own
+  baseline when unset.
+</ParamField>
+
 ## Optional Features

 <ParamField path="PERPLEXITY_API_KEY" type="string">
  API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.
 </ParamField>

+<ParamField path="POSTMAN_API_KEY" type="string">
+  Postman API key (`PMAK-…`). Enables fetching Postman collections by id as a target (`postman://<collection-uid>`), and Postman environments (`postman://<collection-uid>?env=<environment-uid>`) to resolve collection variables. Not needed when passing a local collection export file.
+</ParamField>
+
 <ParamField path="STRIX_TELEMETRY" default="1" type="string">
  Telemetry toggle. Set to `0`, `false`, `no`, or `off` to disable telemetry (PostHog, Scarf, OTEL).
 </ParamField>
@@ -67,7 +110,7 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th

 ## Docker Configuration

-<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.0.0" type="string">
+<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.0" type="string">
  Docker image to use for the sandbox container.
 </ParamField>

@@ -79,10 +122,6 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th
  Runtime backend for the sandbox environment.
 </ParamField>

-<ParamField path="STRIX_MAX_LOCAL_COPY_MB" default="1024" type="integer">
-  Maximum size (in MB) of a local directory target that Strix will copy into the sandbox file-by-file. Larger targets exit early with a suggestion to use `--mount` instead. Set to `0` to disable the check.
-</ParamField>
-
 ## Sandbox Configuration

 <ParamField path="STRIX_SANDBOX_EXECUTION_TIMEOUT" default="120" type="integer">
@@ -68,10 +68,10 @@ Framework-specific testing patterns.

 Third-party service and platform security.

-| Skill                | Coverage                           |
-| -------------------- | ---------------------------------- |
-| `supabase`           | Supabase RLS bypasses, auth issues |
-| `firebase_firestore` | Firestore rules, Firebase auth     |
+| Skill      | Coverage                                               |
+| ---------- | ------------------------------------------------------ |
+| `supabase` | Supabase RLS bypasses, auth issues                     |
+| `firebase` | Firebase Firestore, Storage rules, Auth, and Functions |

 ### Protocols

@@ -81,6 +81,14 @@ Protocol-specific testing techniques.
 | --------- | ------------------------------------------------ |
 | `graphql` | GraphQL introspection, batching, resolver issues |

+### Reconnaissance
+
+Passive discovery and attack-surface mapping techniques.
+
+| Skill             | Coverage                                                        |
+| ----------------- | --------------------------------------------------------------- |
+| `asset_discovery` | CT, TLS SAN pivoting, passive DNS, and ASN/IP asset enumeration |
+
 ### Tooling

 Sandbox CLI playbooks for core recon and scanning tools.
@@ -8,6 +8,7 @@ description: "Contribute to Strix development"
 ### Prerequisites

 - Python 3.12+
+- Latest Go 1.24.x patch (only for Bubble Tea TUI development and release artifacts)
 - Docker (running)
 - [uv](https://docs.astral.sh/uv/)
 - Git
@@ -74,6 +75,22 @@ Skills are specialized knowledge packages that enhance agent capabilities. They
 - Small, focused functions
 - Meaningful variable names

+## Package Builds
+
+Editable installs do not require Go; they run the TUI from source (`go run`).
+
+Wheels are intentionally strict: they always bundle the matching Go sidecar and
+are platform-specific.
+
+```bash
+make wheel
+```
+
+The build hook (`scripts/tui_sidecar_hook.py`) requires Go 1.24.x or newer, embeds
+the sidecar as `strix/bin/strix-tui`, and assigns the current platform tag.
+Frozen releases built by `scripts/build.sh` and `strix.spec` also require the
+sidecar.
+
 ## Reporting Issues

 Include:
@@ -46,7 +46,8 @@
            "group": "Integrations",
            "pages": [
              "integrations/github-actions",
-              "integrations/ci-cd"
+              "integrations/ci-cd",
+              "integrations/coding-agents"
            ]
          },
          {
@@ -0,0 +1,61 @@
+---
+title: "Coding Agents"
+description: "Use Strix from Claude Code, Cursor, Codex, and other AI agents"
+---
+
+Strix is built to be driven by AI coding agents. Install the official agent skills and your agent knows how to run pentests, remediate findings, and wire Strix into CI.
+
+## Install the Skills
+
+Works with any agent that supports the open [SKILL.md standard](https://agentskills.io) — Claude Code, Cursor, Codex, Gemini CLI, OpenCode, and dozens more:
+
+```bash
+npx skills add usestrix/strix
+```
+
+| Skill | What your agent learns |
+|-------|------------------------|
+| `strix-pentest` | Run headless scans against code, URLs, domains, or IPs — self-hosted CLI or managed cloud — with budget caps, and read the results |
+| `strix-cloud-api` | Drive the managed [app.strix.ai](https://app.strix.ai) platform over REST — no local Docker or LLM key needed |
+| `strix-fix-findings` | Triage findings, fix root causes, and re-run Strix to verify each fix |
+| `strix-ci-setup` | Add PR security scanning to GitHub Actions or any CI (self-hosted CLI or managed app) |
+
+Install a single skill with `npx skills add usestrix/strix --skill strix-pentest`, or use one without installing:
+
+```bash
+npx skills use usestrix/strix@strix-pentest | claude
+```
+
+## Two ways to run — self-hosted or managed
+
+Both use the same engine and produce the same validated findings and SARIF, so agents can pick per situation or combine them:
+
+- **Open-source CLI (self-hosted)** — runs locally in a Docker sandbox with your own LLM key. Free, fully local, air-gap capable. Best for local dev loops and full control.
+- **Managed cloud** — runs on Strix's infrastructure via the [app.strix.ai REST API](https://docs.app.strix.ai). No Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Create an API token under **Settings → API Access**; the `strix-cloud-api` skill has the full flow.
+
+## Agent-Friendly Interfaces
+
+Everything an agent needs is machine-readable:
+
+- **Headless CLI** — `strix -n` runs without the TUI and exits with `0` (clean), `1` (error), or `2` (vulnerabilities found).
+- **REST API** — the managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1` (scans, vulnerabilities, assets, PR reviews, schedules, webhooks) with bearer tokens and scopes.
+- **Structured results** — every run writes `vulnerabilities.json`, `vulnerabilities.csv`, `findings.sarif` (SARIF 2.1.0), and per-finding Markdown under `strix_runs/<run-name>/`; the cloud exposes the same as JSON plus SARIF export.
+- **Budget controls** — `--max-budget` and `--max-turns` give agents hard cost/time caps.
+- **`AGENTS.md`** — the [repository's agent guide](https://github.com/usestrix/strix/blob/main/AGENTS.md) with a quick reference.
+- **`llms.txt`** — this documentation is indexed at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) and fully exported at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt); every page is also available as Markdown by appending `.md` to its URL.
+
+## Example Prompts
+
+Once the skills are installed, prompts like these just work:
+
+```text
+Pentest this repo with Strix (quick mode, $10 budget) and summarize the findings.
+```
+
+```text
+Fix all critical and high findings from the last Strix run, then re-scan to verify.
+```
+
+```text
+Add Strix security scanning to our GitHub Actions so every PR gets tested.
+```
@@ -54,3 +54,55 @@ If you use LM Studio, vLLM, or other runners:
 export STRIX_LLM="openai/local-model"
 export LLM_API_BASE="http://localhost:1234/v1"  # Adjust port as needed
 ```
+
+### Gateways that require custom headers
+
+Some OpenAI-compatible gateways require extra HTTP headers (for attribution or
+tenant routing) alongside the bearer token. Set them with `LLM_EXTRA_HEADERS` as
+a JSON object — they are sent on every request:
+
+```bash
+export STRIX_LLM="openai/your-model"
+export LLM_API_BASE="https://your-gateway.example/v1"
+export LLM_API_KEY="your-bearer-token"          # sent as Authorization: Bearer ...
+export LLM_EXTRA_HEADERS='{"X-Feature-Key":"value","X-Tenant":"acme"}'
+```
+
+For endpoints behind a private CA, point Strix at your certificate bundle with
+the standard `SSL_CERT_FILE=/path/to/ca-bundle.pem` — never disable TLS
+verification against a real endpoint.
+
+## Tool calling must return structured `tool_calls`
+
+Strix is entirely tool-driven: every working turn must be a **native** function/tool call. If your inference server returns the tool call as plain assistant text instead of a structured `tool_calls` field, Strix never sees a call it can execute, so the agent makes no real progress — it re-prompts the model for a tool call and gives up once its recovery attempts are exhausted.
+
+This is almost always an **inference-server configuration** problem, not a model or Strix problem. Common symptoms are the model printing a call as text such as:
+
+```text
+<tool_call>{"name": "exec_command", "arguments": {"cmd": "nmap ..."}}</tool_call>
+exec_command(cmd="nmap ...", timeout=180)
+{"action": "exec_command", "params": {"cmd": "nmap ..."}}
+```
+
+The fix belongs on the inference server: it must be configured to parse the model's tool tokens into structured `tool_calls`. A correctly configured endpoint either returns a structured call or rejects the request outright — it never leaks the call as text.
+
+### Fixes by server
+
+**llama.cpp (`llama-server`)**
+- Run with `--jinja` and a correct tool-use chat template (`--chat-template` / `--chat-template-file` matching the model). Recent builds enable `--jinja` by default — **upgrade** if yours doesn't.
+- For thinking models, align or disable reasoning (`--reasoning-format`, `-rea off`) so it doesn't break tool-call parsing.
+- A low temperature (e.g. `--temp 0.2`) improves tool-call reliability.
+
+**Ollama**
+- Use a recent Ollama and a model whose template wires tools. Modern Ollama refuses tools (`tools param requires --jinja flag`) if the template lacks tool support.
+- For reasoning models (e.g. qwen3), disable the model's **thinking** mode — thinking left on frequently pushes the tool call into the text `content` instead of the structured `tool_calls` field. Turn it off on the Ollama side (a non-thinking model variant, or `think: false` in the model's parameters / `Modelfile`).
+- Raise **`num_ctx`** to at least 16k–32k. Strix sends a large system prompt plus many tool schemas; at Ollama's small default context the tool definitions are truncated out of the prompt and the model stops emitting valid calls. A short test prompt can look fine while a real scan fails, so set this explicitly rather than inferring it from a quick check.
+
+**vLLM**
+- Start with `--enable-auto-tool-choice`, a matching `--tool-call-parser` (`hermes`, `qwen3_xml`, or `llama3_json`), and a matching `--reasoning-parser` for reasoning models.
+
+A low sampling temperature (roughly 0.2–0.6, depending on the family) also measurably reduces malformed tool calls on open-weight models. Set it on the server or in your model's parameters.
+
+<Warning>
+Even correctly configured, small models (< ~30B) emit malformed or text-form tool calls far more often than frontier models. Prefer a capable model for reliable agentic behavior.
+</Warning>
@@ -6,33 +6,29 @@ description: "Command-line options for Strix"
 ## Basic Usage

 ```bash
-strix (--target <target> | --target-list <path> | --mount <path>) [options]
+strix (--target <target> | --target-list <path>) [options]
 ```

 ## Options

 <ParamField path="--target, -t" type="string">
-  Target to test. Accepts URLs, repositories, local directories, domains, or IP addresses. Can be specified multiple times. Fresh runs require at least one target source: `--target`, `--target-list`, or `--mount`.
+  Target to test. Accepts URLs, repositories, local directories, domains, IP addresses, API spec files (OpenAPI/Swagger `.json`/`.yaml`, a Postman collection export), or a live Postman collection by id (`postman://<collection-uuid>`). Can be specified multiple times. Fresh runs require at least one target source: `--target` or `--target-list`.
+
+  When the target is an API spec, Strix copies it into the agent's workspace and authorizes the base URLs it declares (including those resolved from a Postman environment) as in-scope hosts - so the agent reads the contract and tests the full declared surface instead of discovering endpoints by crawling. Pair the spec with the deployed base URL (e.g. `--target ./openapi.yaml --target https://api.example.com`) so the agent has a reachable host to attack.
+
+  <Note>
+    A local directory is mounted into the sandbox live and **writable**, so the agent edits your real files (`.git` excepted). Commit or stash first.
+  </Note>
+
+  <Note>
+    Fetching a Postman collection by id requires `POSTMAN_API_KEY`. Add `?env=<environment-uuid>` to also pull a Postman environment, which resolves `{{baseUrl}}` / token variables the collection references (e.g. `postman://<collection-uuid>?env=<environment-uid>`).
+  </Note>
 </ParamField>

 <ParamField path="--target-list" type="string">
  Path to a file containing targets, one per non-empty, non-comment line. Lines starting with `#` are ignored. Can be specified multiple times and combined with `--target`.
 </ParamField>

-<ParamField path="--mount" type="string">
-  Bind-mount a local directory into the sandbox (read-only) instead of copying it in file-by-file. Use this for large repositories that are too big to stream into the container. Can be specified multiple times.
-
-  Strix copies local `--target` directories into the sandbox one file at a time, which stalls on very large trees. When a local target exceeds the copy limit (see `STRIX_MAX_LOCAL_COPY_MB`, default 1024 MB) Strix exits early and asks you to re-run with `--mount`.
-
-  <Note>
-    The mount is read-only to protect your source from accidental modification. This is not a hard security boundary: a root process inside the container can remount it writable, so treat `--mount` as "scan my own code", not as isolation from untrusted code.
-  </Note>
-
-  <Note>
-    The size pre-flight only covers local directory targets. Remote repositories (cloned at scan time) are not size-checked.
-  </Note>
-</ParamField>
-
 <ParamField path="--instruction" type="string">
  Custom instructions for the scan. Use for credentials, focus areas, or specific testing approaches.
 </ParamField>
@@ -61,11 +57,28 @@ strix (--target <target> | --target-list <path> | --mount <path>) [options]
  Path to a custom config file (JSON) to use instead of `~/.strix/cli-config.json`.
 </ParamField>

-<ParamField path="--max-budget-usd" type="number">
+<ParamField path="--max-budget" type="number">
  Maximum LLM spend in USD for the whole scan, counted cumulatively across the
  root agent and every child agent. The budget is checked after each model
-  response; once the running cost reaches the threshold, the scan stops cleanly
-  with a `stopped` status (not a failure) and the sandbox is torn down.
+  response.
+
+  In non-interactive mode (`-n`), once the running cost reaches the threshold,
+  the scan stops cleanly with a `stopped` status (not a failure) and the sandbox
+  is torn down. Sub-agents are stopped early, at 90% of the budget, reserving
+  the final slice for the root agent to wind down and produce the final report.
+
+  In interactive mode, reaching the budget pauses the scan instead of ending
+  it: every agent parks, and sending any message resumes the scan with the cap
+  extended by the original budget amount. There is no sub-agent reserve in
+  interactive mode.
+
+  As the budget is approached, graduated wrap-up warnings are surfaced to
+  **every** agent so they can finish their work and call their lifecycle tool
+  before the hard stop. The bands sit just below each role's own stop point: the
+  root is warned at **70%, 85% and 95%** (it stops at 100%), while sub-agents are
+  warned at **75%, 80% and 85%** (they stop at the 90% reserve). In interactive
+  mode every agent uses the **70%, 85% and 95%** bands. Percentages shown in the
+  warnings are the real cumulative spend against the full budget.

  Must be greater than `0`. Omit the flag for no limit.

@@ -84,6 +97,19 @@ strix (--target <target> | --target-list <path> | --mount <path>) [options]
    counts.
 </ParamField>

+<ParamField path="--max-turns" type="integer" default="500">
+  Maximum number of turns (one model response plus its tool round) allotted to
+  **each** agent, applied per run. When an agent reaches this limit it is
+  force-stopped.
+
+  As the limit is approached, graduated wrap-up warnings (at 70%, 85% and 95%)
+  are injected into that agent's next model turn so it can prioritise its
+  remaining work and call its lifecycle tool (`finish_scan` for the root agent,
+  `agent_finish` for sub-agents) before the hard stop.
+
+  Must be greater than `0`.
+</ParamField>
+
 ## Examples

 ```bash
@@ -99,22 +125,29 @@ strix --target api.example.com --instruction "Focus on IDOR and auth bypass"
 # CI/CD mode
 strix -n --target ./ --scan-mode quick

+# Cap cost and per-agent turns
+strix --target https://example.com --max-budget 25 --max-turns 300
+
 # Force diff-scope against a specific base ref
 strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main

 # Multi-target white-box testing
 strix -t https://github.com/org/app -t https://staging.example.com

+# API spec + live target (OpenAPI/Swagger file or Postman collection)
+strix -t ./openapi.yaml -t https://api.example.com
+
+# Postman collection pulled live by id (+ optional environment)
+strix -t "postman://<collection-uuid>?env=<environment-uuid>"
+
 # Targets from a file
 strix --target-list ./targets.txt
-
-# Large local repository — bind-mount instead of copying it in
-strix --mount ./huge-monorepo
 ```

 ## Exit Codes

 | Code | Meaning |
 |------|---------|
-| 0 | Scan completed, no vulnerabilities found |
+| 0 | Scan completed successfully (interactive mode always exits `0`; in headless mode, `0` means no vulnerabilities were found) |
+| 1 | A fatal error occurred before or during the scan (e.g. missing environment variables, Docker unavailable, invalid config file, diff-scope resolution failure, or an unhandled error) |
 | 2 | Vulnerabilities found (headless mode only) |
@@ -0,0 +1,20 @@
+"""PyInstaller runtime hook: point SSL env vars at the bundled certifi CA file.
+
+Without ``collect_data_files('certifi')`` and this hook, a frozen binary can
+resolve ``certifi.where()`` to a missing path and fail TLS verification with a
+generic ``Connection error`` from httpx/litellm.
+"""
+
+from __future__ import annotations
+
+import sys
+
+
+if getattr(sys, "frozen", False):
+    import os
+
+    import certifi
+
+    ca_bundle = certifi.where()
+    os.environ.setdefault("SSL_CERT_FILE", ca_bundle)
+    os.environ.setdefault("REQUESTS_CA_BUNDLE", ca_bundle)
@@ -1,6 +1,6 @@
 [project]
 name = "strix-agent"
-version = "1.0.4"
+version = "1.5.0"
 description = "Open-source AI Hackers for your apps"
 readme = "README.md"
 license = "Apache-2.0"
@@ -33,15 +33,22 @@ classifiers = [
  "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "openai-agents[litellm]==0.14.6",
+  "openai-agents[litellm]>=0.19.0,<0.20",
+  "openai>=2.45.0,<3",
+  "litellm",
  "pydantic>=2.11.3",
  "pydantic-settings>=2.13.0",
  "rich",
  "docker>=7.1.0",
-  "textual>=6.0.0",
  "requests>=2.32.0",
  "cvss>=3.2",
  "caido-sdk-client>=0.2.0",
+  "reportlab>=4.0",
+  "pypdf>=5.0",
+  # Cap <49: 49.x drops the universal2 macOS wheel (arm64-only), which breaks
+  # the Intel macOS (macos-x86_64) release build's `uv sync --frozen`.
+  "cryptography>=48.0.1,<49",
+  "pyyaml>=6.0",
 ]

 [project.optional-dependencies]
@@ -61,6 +68,7 @@ dev = [
  "pyinstaller>=6.17.0; python_version >= '3.12' and python_version < '3.15'",
  "pytest>=8.3",
  "pytest-asyncio>=0.24",
+  "types-requests>=2.32",
 ]

 [tool.pytest.ini_options]
@@ -72,6 +80,22 @@ build-backend = "hatchling.build"

 [tool.hatch.build.targets.wheel]
 packages = ["strix"]
+# The prebuilt viewer bundle under strix/interface/viewer/static/ ships automatically
+# (hatchling includes non-.py files under the package). The Vite SOURCE lives
+# under the package dir too (strix/interface/viewer/frontend/) but must never ship in the wheel.
+exclude = [
+  "strix/interface/viewer/frontend",
+  "strix/interface/viewer/frontend/**",
+  # Go TUI SOURCE lives under the package dir but must never ship in the wheel;
+  # the compiled sidecar is force-included as strix/bin/strix-tui instead.
+  "strix/interface/tui/cmd/**",
+  "strix/interface/tui/internal/**",
+  "strix/interface/tui/go.mod",
+  "strix/interface/tui/go.sum",
+]
+
+[tool.hatch.build.targets.wheel.hooks.custom]
+path = "scripts/tui_sidecar_hook.py"

 # ============================================================================
 # Type Checking Configuration
@@ -104,11 +128,14 @@ module = [
    "litellm.*",
    "rich.*",
    "jinja2.*",
-    "textual.*",
    "cvss.*",
    "docker.*",
    "caido_sdk_client.*",
    "pydantic_settings.*",
+    "reportlab.*",
+    "pypdf.*",
+    "yaml.*",
+    "pygments.*",
 ]
 ignore_missing_imports = true
 disable_error_code = ["import-untyped"]
@@ -199,6 +226,28 @@ ignore = [
 ]

 [tool.ruff.lint.per-file-ignores]
+# Test doubles use fixture tokens/passwords and match a callee signature whose
+# args they intentionally ignore.
+"tests/test_viewer_auth.py" = ["S105", "S106", "ARG001"]
+"tests/test_codex_auth.py" = ["S105", "S106", "SLF001"]
+# Hatchling loads the build hook by path, not as an importable package.
+"scripts/tui_sidecar_hook.py" = ["INP001"]
+# PyInstaller runtime hooks are loaded by path, not as an importable package.
+"hooks/rthooks/pyi_rth_certifi.py" = ["INP001"]
+# Stdlib HTTP handler overrides (do_GET/do_POST).
+"strix/interface/auth_cli.py" = ["N802"]
+"tests/test_codex_streaming.py" = ["N802"]
+"tests/test_disable_streaming.py" = ["N802"]
+"tests/test_tool_call_ids.py" = ["N802"]
+"tests/test_tool_call_limits.py" = ["N802", "SLF001"]
+"tests/test_stream_idle_timeout.py" = ["N802", "SLF001"]
+"tests/test_unknown_tool_recovery.py" = ["N802"]
+"tests/test_report_pdf.py" = ["S105", "S106"]
+# Stdlib HTTP handler overrides (do_GET/do_POST) and lazy imports that avoid a
+# circular dependency with strix.telemetry / strix.interface.viewer.report_pdf.
+"strix/interface/viewer/server.py" = ["N802", "PLC0415"]
+# Lazy telemetry import to avoid importing PostHog before the viewer starts.
+"strix/interface/viewer/cli.py" = ["PLC0415"]
 # Lazy imports inside functions to avoid circular dependency with
 # strix.telemetry / strix.report.dedupe / cvss.
 "strix/tools/notes/tools.py" = ["PLC0415", "TC002"]
@@ -231,18 +280,31 @@ ignore = [
 "strix/core/runner.py" = ["TC003", "PLR0912", "PLR0915", "PLC0415"]
 # ReportState carries scan artifact/report fields and
 # a runtime ``Callable`` annotation on ``vulnerability_found_callback``.
-"strix/report/state.py" = ["TC003", "PLR0912", "PLR0915", "E501", "PERF401"]
+"strix/report/state.py" = ["TC003", "PLR0912", "PLR0915", "E501", "PERF401", "PLC0415"]
 "strix/report/usage.py" = ["PLC0415"]
+# Lazy import of strix.config.models avoids a circular dependency between the
+# report pipeline and the config layer.
+"strix/report/dedupe.py" = ["PLC0415"]
+"strix/telemetry/logging.py" = ["PLC0415"]
 "strix/config/models.py" = ["PLC0415"]
+# Heavy inference deps (httpx, openai) imported lazily so auth-status checks
+# don't pull them in.
+"strix/config/codex.py" = ["PLC0415"]
 # Interface utility branches per scope-mode / target-type combination;
 # splitting would obscure the decision tree without simplifying it.
 "strix/interface/utils.py" = ["PLR0912", "BLE001", "PLC0415"]
 # CLI / TUI / main keep extensive lazy imports + broad exception
 # swallows for resilience around terminal-rendering errors.
 "strix/interface/cli.py" = ["BLE001", "PLC0415"]
-"strix/interface/tui/app.py" = ["BLE001", "PLC0415", "PLR0912", "PLR0915", "SIM105"]
+"strix/interface/scan_setup.py" = ["PLC0415"]
 "strix/interface/main.py" = ["BLE001", "PLC0415", "PLR0912", "PLR0915"]
-"strix/interface/tui/renderers/agent_message_renderer.py" = ["PLC0415"]
+"strix/interface/cli_args.py" = ["BLE001", "PLC0415", "PLR0912", "PLR0915"]
+"strix/interface/environment.py" = ["BLE001", "PLC0415", "PLR0912", "PLR0915"]
+# The Go TUI runtime and backend controller import interface modules lazily so
+# the sidecar entry point stays fast and avoids circular imports.
+"strix/interface/interactive.py" = ["PLC0415"]
+"strix/interface/tui/runtime.py" = ["PLC0415"]
+"strix/interface/tui/backend/controller.py" = ["PLC0415"]

 [tool.ruff.lint.isort]
 force-single-line = false
@@ -39,6 +39,12 @@ if ! command -v uv &> /dev/null; then
    exit 1
 fi

+if ! command -v go &> /dev/null; then
+    echo -e "${RED}Error: Go is not installed${NC}"
+    echo "Go 1.24 or newer is required to build the Bubble Tea TUI."
+    exit 1
+fi
+
 echo -e "\n${BLUE}Installing dependencies...${NC}"
 uv sync --frozen

@@ -48,6 +54,14 @@ echo -e "${YELLOW}Version:${NC} $VERSION"
 echo -e "\n${BLUE}Cleaning previous builds...${NC}"
 rm -rf build/ dist/

+echo -e "\n${BLUE}Building Bubble Tea sidecar...${NC}"
+TUI_BINARY="build/sidecar/strix-tui"
+if [ "$OS_NAME" = "windows" ]; then
+    TUI_BINARY="${TUI_BINARY}.exe"
+fi
+mkdir -p build/sidecar
+(cd strix/interface/tui && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o "../../../$TUI_BINARY" ./cmd/strix-tui)
+
 echo -e "\n${BLUE}Building binary with PyInstaller...${NC}"
 uv run pyinstaller strix.spec --noconfirm

@@ -4,7 +4,7 @@ set -euo pipefail

 APP=strix
 REPO="usestrix/strix"
-STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.0.0"
+STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.0"

 MUTED='\033[0;2m'
 RED='\033[0;31m'
@@ -41,7 +41,7 @@ fi

 combo="$os-$arch"
 case "$combo" in
-  linux-x86_64|macos-x86_64|macos-arm64|windows-x86_64)
+  linux-x86_64|linux-arm64|macos-x86_64|macos-arm64|windows-x86_64)
    ;;
  *)
    echo -e "${RED}Unsupported OS/Arch: $os/$arch${NC}"
@@ -0,0 +1,58 @@
+"""Hatchling build hook that compiles and bundles the Go TUI sidecar."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sysconfig
+from pathlib import Path
+from typing import Any
+
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+
+
+class CustomBuildHook(BuildHookInterface[Any]):
+    """Compile the Bubble Tea sidecar and ship it inside the wheel.
+
+    The sidecar is the only interactive interface, so every wheel is a
+    platform wheel and a missing Go toolchain is a build failure.
+    """
+
+    def initialize(self, version: str, build_data: dict[str, Any]) -> None:
+        # Editable installs run from the checkout, where the TUI is started
+        # with ``go run``; there is nothing to bundle.
+        if version == "editable":
+            return
+
+        root = Path(self.root)
+        executable = "strix-tui.exe" if os.name == "nt" else "strix-tui"
+        output = root / "build" / "sidecar" / executable
+        output.parent.mkdir(parents=True, exist_ok=True)
+
+        go = shutil.which("go")
+        if go is None:
+            raise RuntimeError("Go 1.24 or newer is required to build the Bubble Tea TUI")
+        env = os.environ.copy()
+        env["CGO_ENABLED"] = "0"
+        subprocess.run(  # noqa: S603 - fixed build command using the resolved Go binary
+            [
+                go,
+                "build",
+                "-trimpath",
+                "-ldflags=-s -w",
+                "-o",
+                str(output),
+                "./cmd/strix-tui",
+            ],
+            cwd=root / "strix" / "interface" / "tui",
+            env=env,
+            check=True,
+        )
+
+        build_data["force_include"][str(output)] = f"strix/bin/{executable}"
+        build_data["pure_python"] = False
+        platform_tag = os.environ.get("STRIX_WHEEL_PLATFORM_TAG")
+        if not platform_tag:
+            platform_tag = sysconfig.get_platform().replace("-", "_").replace(".", "_")
+        build_data["tag"] = f"py3-none-{platform_tag}"
@@ -0,0 +1,136 @@
+---
+name: strix-ci-setup
+description: Wire Strix security scanning into CI/CD — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, pentesting, or Strix to their CI pipeline or PR workflow.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.strix.ai
+---
+
+# Set up Strix in CI/CD
+
+You can gate PRs two ways — pick based on the environment, or combine them:
+
+- **Managed platform (recommended for most teams)** — connect the GitHub/GitLab/Bitbucket app once and Strix reviews every PR with **no workflow file, no runner, no Docker, and no LLM key**. Results post as PR comments and land in the team dashboard. Best when you want zero CI maintenance, central tracking, or your runners lack Docker. See "Managed platform" below and the **strix-cloud-api** skill.
+- **Self-hosted OSS CLI in your runner** — run a diff-scoped scan as a pipeline step. Fully in your infra, free (BYO LLM key), no external account. Requires Docker on the runner. Best for air-gapped/self-hosted CI or when you don't want scans leaving your environment.
+
+Both fail the build on validated findings and both emit SARIF 2.1.0, so you can start with one and add the other later.
+
+---
+
+# Option A — Self-hosted OSS CLI in the runner
+
+Run a diff-scoped Strix scan on every PR: only changed files are tested, `quick` mode keeps it fast, and exit code `2` fails the build when validated vulnerabilities are found.
+
+## GitHub Actions
+
+Create `.github/workflows/security.yml`:
+
+```yaml
+name: Security Scan
+
+on:
+  pull_request:
+
+jobs:
+  strix-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # required for diff-scope resolution
+
+      - name: Install Strix
+        run: curl -sSL https://strix.ai/install | bash
+
+      - name: Run Security Scan
+        env:
+          STRIX_LLM: ${{ secrets.STRIX_LLM }}
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: strix -n -t ./ --scan-mode quick --max-budget 10
+
+      # Don't fail open: a run that hits the hard budget stop exits 0 but leaves
+      # run.json status "stopped", not "completed". Enforce completion explicitly.
+      # This does not catch an agent that wrapped up early on a budget *warning*
+      # (it still calls finish_scan and records "completed"), so size the budget.
+      - name: Fail unless the scan completed
+        run: |
+          run_json=$(ls -t strix_runs/*/run.json | head -1)
+          status=$(jq -r .status "$run_json")
+          if [ "$status" != "completed" ]; then
+            echo "Strix run status is '$status' — the scan did not complete (likely budget exhausted). Raise --max-budget." >&2
+            exit 1
+          fi
+```
+
+Then tell the user to add two repository secrets: `STRIX_LLM` (model id, e.g. `openai/gpt-5.4`) and `LLM_API_KEY` (the provider key). Do not create these values yourself.
+
+Notes:
+- In CI/headless runs Strix automatically scopes to the PR's changed files (`--scope-mode auto`). If diff resolution fails, keep `fetch-depth: 0` or set `--diff-base` to the PR's actual base branch — use `origin/${{ github.base_ref }}` in GitHub Actions rather than a hard-coded `origin/main`, since repos use different default branches.
+- Exit codes: `0` pass, `2` vulnerabilities found (fails the job), `1` setup error.
+- The runner needs Docker (default GitHub-hosted Ubuntu runners have it).
+- **Size the budget so the scan completes — don't let it fail open.** A `0` exit means "no validated vulnerabilities in what was analyzed"; if `--max-budget` is hit before the diff is fully covered, the scan wraps up early and can still exit `0`. The "Fail unless the scan completed" step above narrows the gap: `strix_runs/<run>/run.json` is `"stopped"` when the scan was cut off at the hard budget limit without a final report. It is not a complete guard — the agents get graduated wrap-up warnings before that limit, and a run that wraps up on a warning still calls `finish_scan` and records `"completed"` with partial coverage. So keep that step in any pipeline that gates merges **and** give the scan real headroom (compare `run.json`'s `llm_usage.cost` against `--max-budget`; if it ran right up to the cap, raise it). For a `quick` diff-scoped PR scan `--max-budget 10` is usually ample, raise it for large diffs.
+
+### Optional: upload findings to GitHub code scanning
+
+Strix writes SARIF 2.1.0 to `strix_runs/<run>/findings.sarif`:
+
+```yaml
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: strix_runs
+```
+
+## Other CI systems
+
+Any pipeline works the same way — install, set the two env vars, run headless:
+
+```bash
+curl -sSL https://strix.ai/install | bash
+# Resolve the PR's base branch robustly (use your CI's base-branch variable if it
+# has one, e.g. GitHub Actions: origin/${{ github.base_ref }}). Avoid piping the
+# git lookup into another command — a failed lookup would otherwise be masked.
+BASE_BRANCH="${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-}"   # GitLab MR target
+if [ -z "$BASE_BRANCH" ]; then
+  BASE_BRANCH=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
+  BASE_BRANCH="${BASE_BRANCH#origin/}"
+fi
+DIFF_BASE="origin/${BASE_BRANCH:-main}"
+# Fail loudly rather than silently narrowing scope (e.g. to HEAD~1, which on a
+# multi-commit branch would scan only the last commit and let earlier ones pass).
+if ! git rev-parse --verify --quiet "$DIFF_BASE" >/dev/null; then
+  echo "Cannot resolve diff base '$DIFF_BASE'. Fetch the base branch (git fetch origin <base>) or set --diff-base explicitly." >&2
+  exit 1
+fi
+strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base "$DIFF_BASE" --max-budget 10
+```
+
+Gate the pipeline on the exit code (see the budget/fail-open caveat above — give the scan enough budget to finish). Schedule `standard` scans nightly and `deep` scans for release candidates.
+
+---
+
+# Option B — Managed platform (no runner infra)
+
+No workflow file, no Docker, no LLM key. Two ways to use it:
+
+1. **PR-review app (zero code):** the user installs the Strix GitHub/GitLab/Bitbucket app and enables PR reviews for the repo in the app.strix.ai dashboard. Every PR is then reviewed automatically, with findings posted as PR comments. Nothing to add to the repo. This is the lowest-effort path — recommend it first when the user just wants PR gating.
+
+2. **API-triggered from any pipeline:** if you want to trigger from an existing pipeline (or a system without the SCM app), call the API with a token that has `pr_reviews:write` (or `scans:write`). Store the token as a CI secret; ask the user to create it at **Settings → API Access**. Example GitHub Actions step:
+
+   ```yaml
+   - name: Strix PR review (managed)
+     if: github.event_name == 'pull_request'
+     env:
+       STRIX_API_TOKEN: ${{ secrets.STRIX_API_TOKEN }}
+     run: |
+       curl -sS --fail https://app.strix.ai/api/v1/pr-reviews/start \
+         -H "Authorization: Bearer $STRIX_API_TOKEN" \
+         -H "Content-Type: application/json" \
+         -d "{\"repository_full_name\":\"${{ github.repository }}\",\"pr_number\":${{ github.event.pull_request.number }}}"
+   ```
+
+   To gate the build on results, poll the PR review / scan status and fail on unresolved criticals/highs. Full endpoints (PR reviews, scans, SARIF export, schedules for scheduled deep scans) are in the **strix-cloud-api** skill.
+
+Recommend Option B for most teams (no maintenance, central dashboard); use Option A when scans must stay entirely within your own infrastructure.
@@ -0,0 +1,152 @@
+---
+name: strix-cloud-api
+description: Drive the managed Strix platform headlessly through the app.strix.ai REST API — create an API token, register domain/repository assets, launch and poll pentest scans, list and triage vulnerabilities, export SARIF, download PDF/DOCX reports (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants Strix without local Docker/LLM infra, or wants scans tracked in a team dashboard, on a schedule, or in CI via API.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.app.strix.ai
+---
+
+# Strix Cloud API (managed, no local infra)
+
+Use this when you want Strix's autonomous pentesting **without running Docker or an LLM yourself** — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the **strix-pentest** skill instead — both share the same engine and SARIF output, so you can mix them.
+
+Full reference: **[docs.app.strix.ai](https://docs.app.strix.ai)** · OpenAPI: `https://docs.app.strix.ai/openapi.json`
+
+## Setup
+
+- **Base URL:** `https://app.strix.ai/api/v1`
+- **Auth:** every request sends `Authorization: Bearer <token>`. Tokens are **org-scoped**.
+- **Get a token:** the user creates one in the dashboard at **Settings → API Access** (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store.
+- **Scopes (least-privilege):** assign only what the integration needs and rotate regularly:
+
+  | Scope | Grants |
+  |---|---|
+  | `scans:read` / `scans:write` | list/read/report scans · create/rerun/cancel scans |
+  | `vulnerabilities:read` / `:write` | read findings · update status & notes |
+  | `assets:read` / `:write` | read domains/repos · register/update them |
+  | `schedules:read` / `:write` | read schedules · create/trigger recurring scans |
+  | `pr_reviews:write` | trigger PR security reviews |
+  | `webhooks:read` / `:write` | manage webhook subscriptions |
+  | `tokens:write` | create/revoke API tokens |
+
+```bash
+export STRIX_API_TOKEN="<token>"
+BASE=https://app.strix.ai/api/v1
+auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")
+```
+
+All examples use `jq` to parse JSON. Handle HTTP errors: `401` bad/expired token, `402` out of credits, `403` scope/plan-tier limit, `422` validation error.
+
+## 1. Register the target as an asset
+
+Scans run against **registered assets**, not raw URLs. Register once, then reuse the returned UUID.
+
+```bash
+# Domain (black-box / live target). Requires domain verification before external scanning.
+# asset_type must be one of: web_app | api | attack_surface.
+curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json" \
+  -d '{"domain":"staging.example.com","asset_type":"web_app"}' | jq '{id:.domain.id, status, reachable, verification}'
+
+# Repository (white-box / code review). `full_name` is "owner/name".
+# Send one repository object, or a bare JSON array for several — not an object
+# wrapping a "repositories" key (that is rejected with 400).
+curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json" \
+  -d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'
+```
+
+Look up existing assets instead of re-adding: `GET /domains`, `GET /repositories` (both `assets:read`, paginated with `?page=&limit=`).
+
+## 2. Launch a scan
+
+`POST /scans` (`scans:write`). Provide at least one target via `domain_ids`, `repository_ids`, or `internal_targets` (internal infra needs a network connector — see docs).
+
+```bash
+scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
+  "engagement_type": "live_test",
+  "domain_ids": ["<domain-uuid>"],
+  "focus": "IDOR, auth bypass, SSRF",
+  "context": "Staging. Test account creds are configured as a test user.",
+  "notify_on_completion": true
+}' | jq -r .scan_id)
+echo "$scan_id"
+```
+
+Useful `CreateScanRequest` fields:
+
+| Field | Purpose |
+|---|---|
+| `engagement_type` | `live_test` (default), `code_review`, `internal_infra`, `compliance_pentest` |
+| `domain_ids` / `repository_ids` / `internal_targets` | targets (at least one) |
+| `domain_paths` / `repository_branches` | narrow to specific paths / branches |
+| `credentials` | authenticated scanning, incl. `mfa_method` (`totp`/`email_otp`/…) + `totp_secret` |
+| `headers` | extra HTTP headers (e.g. API keys) for the target |
+| `focus` / `concerns` / `context` | steer the agents |
+| `upload_ids` | attach uploaded source/docs archives for white-box context |
+| `notify_on_completion` / `notification_emails` | email when done |
+
+Response is `{ scan_id, title, status }` with `status` = `pending`.
+
+## 3. Poll to completion
+
+`GET /scans/{scanId}` (`scans:read`). Status flow: `pending → running → completed` (or `failed` / `cancelled`). Poll on an interval — scans take minutes to hours; don't block.
+
+```bash
+while :; do
+  s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
+  echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
+  sleep 60
+done
+```
+
+## 4. Read findings
+
+The scan-detail response includes `executive_summary`, `methodology`, `recommendations`, a `findings` severity roll-up, and a `vulnerabilities[]` array. Each vulnerability carries `title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code`, and (for code findings) `code_file`/`code_diff`/`code_before`/`code_after`.
+
+```bash
+curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
+  | jq '["critical","high","medium","low","info"] as $order
+       | .vulnerabilities
+       | sort_by(.severity as $s | $order | index($s))
+       | .[] | {title, severity, endpoint, cwe}'
+```
+
+Cloud severities are `critical | high | medium | low` and statuses are `open | in_progress | fixed | ignored`. Sort by an explicit severity order rather than `sort_by(.severity)`, which sorts alphabetically (critical, high, low, medium).
+
+Org-wide triage across scans: `GET /vulnerabilities` (`vulnerabilities:read`; filter by severity/status). Update triage state with the vulnerabilities `:write` endpoints. To remediate, hand off to the **strix-fix-findings** skill.
+
+## 5. Export & report
+
+```bash
+# SARIF 2.1.0 for GitHub code scanning / ASPM ingestion
+curl -sS "$BASE/scans/$scan_id/sarif" "${auth[@]}" -o findings.sarif
+
+# Report. The format and file type are query params (`Accept` is ignored):
+#   format=technical (default) | retest | attestation | executive_summary
+#   type=pdf (default) | docx
+# Any report download requires the Enterprise plan; formats beyond `technical`,
+# DOCX, and white-label branding are Enterprise-only too. Scan must be completed.
+curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf
+```
+
+## 6. PR reviews
+
+Trigger an automated security review of a pull request (`pr_reviews:write`); results appear as PR comments and in the dashboard:
+
+```bash
+curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
+  -d '{"repository_full_name":"org/app","pr_number":123}'
+```
+
+List/inspect via `GET /pr-reviews` and `GET /pr-reviews/{id}`. Repo-level PR-review behavior is configured with the repository-settings endpoint.
+
+## 7. Continuous testing (schedules & webhooks)
+
+- **Schedules** (`schedules:write`, Pro plan): create recurring scans and trigger them on demand — the managed equivalent of a cron-driven CLI loop.
+- **Webhooks** (`webhooks:write`): subscribe to pentest/vulnerability lifecycle events (e.g. `scan.completed`, `vulnerability.created`) to push results into Slack, ticketing, or your own pipeline instead of polling.
+
+See the schedules and webhooks sections at [docs.app.strix.ai](https://docs.app.strix.ai) for payloads.
+
+## Safety
+
+Only scan assets the user's organization owns or is authorized to test. External domain scans require verification (DNS/file/meta-tag) enforced by the platform — don't try to bypass it.
@@ -0,0 +1,77 @@
+---
+name: strix-fix-findings
+description: Triage and remediate vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud), then re-run Strix to verify each fix. Use after a Strix scan reports findings, or when the user asks to fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan's vulnerabilities.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.strix.ai
+---
+
+# Fix Strix findings and verify
+
+Turn validated Strix findings into minimal, correct fixes — and prove they work by re-scanning.
+
+## 1. Triage
+
+Get the findings from wherever the scan ran:
+
+- **OSS CLI** — artifacts in `strix_runs/<run-name>/`:
+  - `vulnerabilities/*.md` — one finding per file: description, severity, PoC steps or script, affected code locations, remediation guidance.
+  - `vulnerabilities.json` — the same findings as JSON (ids, severity, CWE/CVE, `code_locations` with `fix_before`/`fix_after` suggestions when available).
+- **Cloud (app.strix.ai)** — fetch the scan's `vulnerabilities[]` via `GET /api/v1/scans/{scanId}` (or `GET /api/v1/vulnerabilities` org-wide). Each carries `severity, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code` and, for code findings, `code_file`/`code_diff`/`code_before`/`code_after`. See the **strix-cloud-api** skill for auth.
+
+Order work by severity: critical → high → medium → low. Every Strix finding was validated with a working proof-of-concept, so do not dismiss findings as false positives without re-testing the PoC yourself.
+
+## 2. Fix
+
+For each finding:
+
+1. Reproduce it with the PoC from the finding file when feasible.
+2. Fix the root cause, not the specific payload (e.g. parameterize all queries, don't blocklist one string; enforce authorization in the handler, don't hide the endpoint).
+3. Prefer the framework's built-in defense (ORM parameterization, template auto-escaping, CSRF middleware, centralized authz) over ad-hoc sanitization.
+4. Keep the diff minimal and apply the repo's existing patterns. Finding files often include `fix_before`/`fix_after` snippets — use them as a starting point, not verbatim.
+
+Common finding classes and expected fixes: injection → parameterization/escaping at the sink; IDOR/broken access control → object-level authorization checks; SSRF → allowlist + block internal ranges; XSS → context-aware output encoding + CSP; secrets exposure → rotate the secret AND remove it from code/history; auth issues → fix the server-side check (never client-side).
+
+## 3. Verify by re-running Strix
+
+After fixing, re-scan scoped to the fixed area and confirm the finding is gone. Verify in whichever environment you scanned (or both):
+
+**OSS CLI:**
+```bash
+# Re-test just the changed files (fast). Resolve the repo's real default
+# branch instead of assuming origin/main (many repos use master/develop).
+# Avoid the current branch's own upstream as the base — its merge base with
+# HEAD would be HEAD, giving an empty diff and a falsely clean result.
+DIFF_BASE=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
+# origin/HEAD can be a dangling symbolic ref — keep it only if its target exists.
+git rev-parse --verify --quiet "$DIFF_BASE" >/dev/null 2>&1 || DIFF_BASE=""
+if [ -z "$DIFF_BASE" ]; then
+  for b in origin/main origin/master origin/develop; do
+    git rev-parse --verify --quiet "$b" >/dev/null && DIFF_BASE="$b" && break
+  done
+fi
+# No silent fallback: a guess like HEAD~1 would cover only the last commit of a
+# multi-commit fix branch. If no base resolves, ask the user for the base branch
+# (or use the focused --instruction verification below, which needs no diff base).
+[ -n "$DIFF_BASE" ] || { echo "Set DIFF_BASE to the branch your fix will merge into." >&2; exit 1; }
+strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base "$DIFF_BASE" --max-budget 5
+
+# Or re-test with the original finding as focus (no diff base needed)
+strix -n -t ./ --instruction "Verify the SQL injection in app/api/search.py is fixed. Original PoC: <poc>" --max-budget 5
+```
+Exit codes: `2` = findings remain (read the new `strix_runs/<run>/vulnerabilities/` and iterate); `0` = clean **for what was analyzed**. Before trusting a `0`, confirm the run wasn't cut short — check `run.json` for a completed status and compare its `llm_usage.cost` with `--max-budget`: a hard budget stop leaves `status: "stopped"`, but a run that wrapped up on a budget warning records `"completed"` with partial coverage. Give verification enough budget to finish, and prefer re-running the specific PoC as the ground-truth signal.
+
+**Cloud:** rerun with the same config and re-poll, then confirm the finding no longer appears:
+```bash
+new_id=$(curl -sS "$BASE/scans/$scan_id/rerun" "${auth[@]}" -X POST | jq -r .scan_id)
+# poll GET /scans/$new_id until completed, then check its vulnerabilities[]
+```
+Or, if the cloud scan came from a repo/PR, trigger a fresh PR review on the fix branch (`POST /pr-reviews/start`). The platform also retests a single finding directly: `POST /api/v1/vulnerabilities/{vulnerabilityId}/retest`.
+
+- Also re-run the PoC manually when it is a simple request/script — fastest signal.
+- Run the project's own test suite to make sure the fix doesn't break behavior.
+
+## 4. Report
+
+Summarize per finding: severity, root cause, fix applied (file:line), verification result (re-scan clean / PoC no longer reproduces). Never include live secrets in the report; if a secret leaked, state that rotation is required.
@@ -0,0 +1,143 @@
+---
+name: strix-pentest
+description: Run an autonomous AI penetration test with Strix against a codebase, repository, URL, domain, or IP — either self-hosted with the open-source CLI or via the managed app.strix.ai cloud API — and read the validated findings (Markdown, JSON, CSV, SARIF, PoCs). Use when the user asks to pentest, security-scan, or find vulnerabilities in an app, API, website, or repo with Strix.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.strix.ai
+---
+
+# Run a Strix pentest
+
+Strix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are **two ways to run it, built on the same engine and producing the same findings** — pick per situation, and mix them freely:
+
+- **Open-source CLI** (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: [docs.strix.ai](https://docs.strix.ai).
+- **Cloud API** (managed) — runs on Strix's infrastructure via `https://app.strix.ai/api/v1`. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF/DOCX reports (Enterprise plan), and internal-network connectors. Docs: [docs.app.strix.ai](https://docs.app.strix.ai). Full workflow in the **strix-cloud-api** skill.
+
+## Which one? (decide, don't default)
+
+Choose honestly based on the situation — neither is "better":
+
+| Situation | Prefer |
+|---|---|
+| No Docker available, or a sandboxed/hosted agent/CI environment | **Cloud** |
+| User has no LLM key / doesn't want to pay per-token or manage models | **Cloud** |
+| Team visibility, shareable dashboard, scheduled/continuous scans, PR reviews, downloadable PDF/DOCX report (Enterprise) | **Cloud** |
+| Scanning internal/private infrastructure not reachable from your machine | **Cloud** (network connector) |
+| Source must never leave local infra (privacy/air-gap), or fully offline | **OSS CLI** |
+| Free / one-off / local dev-loop scan, Docker already present | **OSS CLI** |
+| BYO or self-hosted LLM, or a specific model not offered by the platform | **OSS CLI** |
+| CI: runner already has Docker and you want a self-contained gate | **OSS CLI** |
+| CI: no Docker, or you want results tracked centrally | **Cloud** |
+
+**Mix them:** e.g. use the OSS CLI for the fast local dev-loop while writing/fixing code, and the Cloud for the authoritative, team-visible scan + report + tracking; or gate PRs with the OSS CLI in CI while the Cloud runs scheduled deep scans and PR reviews across the org. Both emit the same SARIF 2.1.0, so findings line up across environments.
+
+If unsure and the user has (or will create) an app.strix.ai account, prefer **Cloud** — it avoids all local-infra friction. If they want zero signup / full local control, use the **OSS CLI**.
+
+---
+
+# Option A — Open-source CLI (self-hosted)
+
+## Prerequisites
+
+1. **Docker running** — check with `docker info`. The first scan pulls the sandbox image automatically.
+2. **Strix installed** — check with `strix --version`. Install if missing:
+   ```bash
+   curl -sSL https://strix.ai/install | bash   # or: pipx install strix-agent
+   ```
+3. **LLM configured** — two environment variables:
+   ```bash
+   export STRIX_LLM="openai/gpt-5.4"      # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
+   export LLM_API_KEY="<provider api key>"
+   ```
+   Ask the user for these if unset. Never hardcode or commit keys.
+
+## Running a scan
+
+Always use `-n` (non-interactive/headless) — the default TUI blocks agents. Always set `--max-budget` unless the user says otherwise.
+
+```bash
+# Local code (white-box)
+strix -n -t ./ --scan-mode standard --max-budget 10
+
+# Deployed app / API (black-box)
+strix -n -t https://staging.example.com --max-budget 20
+
+# Repo + deployed app together (best coverage)
+strix -n -t https://github.com/org/app -t https://staging.example.com
+
+# Focused testing with credentials or scope hints
+strix -n -t https://app.example.com \
+  --instruction "Use credentials user@example.com:pass123. Focus on IDOR and auth bypass."
+
+# Large monorepo: bind-mount instead of copying
+strix -n --mount ./huge-monorepo
+```
+
+Key flags:
+
+| Flag | Meaning |
+|---|---|
+| `-t, --target` | URL, repo URL, local path, domain, or IP. Repeatable. |
+| `-n, --non-interactive` | Headless, exits on completion. Required for agents. |
+| `-m, --scan-mode` | `quick` (minutes) / `standard` (~30 min) / `deep` (hours, default). |
+| `--instruction` / `--instruction-file` | Credentials, focus areas, scope rules. |
+| `--max-budget USD` | Hard LLM spend cap; scan wraps up cleanly at the limit. |
+| `--max-turns N` | Per-agent turn cap (default 500). |
+| `--resume RUN_NAME` | Resume a prior run from `strix_runs/`. |
+
+Scans take minutes (`quick`) to hours (`deep`). Run them in the background and poll for completion rather than blocking.
+
+### Exit codes (headless)
+
+- `0` — finished with no validated vulnerabilities **in what was analyzed**
+- `1` — fatal error (missing env vars, Docker down, bad config)
+- `2` — vulnerabilities found
+
+A `0` is not proof of full coverage: if `--max-budget`/`--max-turns` is reached before the scan completes, it wraps up early and still exits `0`. When you need assurance the scan finished, give it enough budget and check `strix_runs/<run>/run.json`: a hard budget stop leaves `status: "stopped"`, but an agent that wrapped up early on a budget *warning* still calls `finish_scan` and records `"completed"` — so also sanity-check the run's cost against `--max-budget` and the report's stated coverage before treating a clean result as full coverage.
+
+### Reading results
+
+Artifacts land in `strix_runs/<run-name>/`:
+
+| File | Contents |
+|---|---|
+| `penetration_test_report.md` | Executive report — read this first. |
+| `vulnerabilities/*.md` | One file per validated finding, with PoC and remediation. |
+| `vulnerabilities.json` / `vulnerabilities.csv` | All findings as structured JSON / CSV index. |
+| `findings.sarif` | SARIF 2.1.0 for GitHub code scanning / ASPM ingestion. |
+| `run.json` | Run metadata, status, targets, usage/cost. |
+
+---
+
+# Option B — Cloud API (managed, no local infra)
+
+Full details, asset registration, polling, reports, PR reviews, schedules, and webhooks are in the **strix-cloud-api** skill. Minimal launch-and-poll:
+
+```bash
+export STRIX_API_TOKEN="<token>"   # org-scoped bearer, from Settings → API Access at app.strix.ai
+BASE=https://app.strix.ai/api/v1
+
+# 1. Launch a scan against an already-registered domain/repo asset
+scan_id=$(curl -sS "$BASE/scans" \
+  -H "Authorization: Bearer $STRIX_API_TOKEN" -H "Content-Type: application/json" \
+  -d '{"engagement_type":"live_test","domain_ids":["<domain-uuid>"]}' | jq -r .scan_id)
+
+# 2. Poll until terminal (pending → running → completed/failed/cancelled)
+curl -sS "$BASE/scans/$scan_id" -H "Authorization: Bearer $STRIX_API_TOKEN" | jq '.status'
+
+# 3. Read validated findings from the scan detail's `vulnerabilities[]`, or export SARIF
+curl -sS "$BASE/scans/$scan_id/sarif" -H "Authorization: Bearer $STRIX_API_TOKEN" -o findings.sarif
+```
+
+Ask the user to create the token (and register the target as a domain/repository asset) if they haven't. If Docker/local prerequisites aren't already satisfied, use this path instead of trying to install infra.
+
+---
+
+## Reporting & next steps
+
+Summarize findings by severity (critical/high/medium/low/info) and include the PoC evidence. To remediate and verify fixes (via either path), use the **strix-fix-findings** skill. To wire scanning into CI/CD, use the **strix-ci-setup** skill.
+
+## Safety
+
+Only scan targets the user owns or is authorized to test. The Cloud platform enforces domain verification before external scans; for the OSS CLI, confirm authorization yourself if the target looks like third-party infrastructure.
@@ -7,6 +7,14 @@ from PyInstaller.utils.hooks import collect_data_files, collect_submodules
 project_root = Path(SPECPATH)
 strix_root = project_root / 'strix'

+tui_name = 'strix-tui.exe' if sys.platform == 'win32' else 'strix-tui'
+tui_binary = project_root / 'build' / 'sidecar' / tui_name
+if not tui_binary.is_file():
+    raise FileNotFoundError(
+        f'Missing Go TUI sidecar at {tui_binary}; run `make tui-build` first'
+    )
+binaries = [(str(tui_binary), 'strix/bin')]
+
 datas = []

 for md_file in strix_root.rglob('skills/**/*.md'):
@@ -21,16 +29,20 @@ for xml_file in strix_root.rglob('*.xml'):
    rel_path = xml_file.relative_to(project_root)
    datas.append((str(xml_file), str(rel_path.parent)))

-for tcss_file in strix_root.rglob('*.tcss'):
-    rel_path = tcss_file.relative_to(project_root)
-    datas.append((str(tcss_file), str(rel_path.parent)))
-
-datas += collect_data_files('textual')
+# Prebuilt local-viewer SPA (served by `strix view`).
+viewer_static = strix_root / 'interface' / 'viewer' / 'static'
+for asset in viewer_static.rglob('*'):
+    if asset.is_file():
+        rel_path = asset.relative_to(project_root)
+        datas.append((str(asset), str(rel_path.parent)))

 datas += collect_data_files('tiktoken')
 datas += collect_data_files('tiktoken_ext')

 datas += collect_data_files('litellm')
+# Frozen binaries need certifi's CA bundle on disk; without it TLS to LLM
+# providers fails with a generic httpx/litellm "Connection error".
+datas += collect_data_files('certifi')

 datas += collect_data_files('agents', includes=['**/*.md', '**/*.jinja', '**/*.json'])

@@ -45,17 +57,6 @@ hiddenimports = [
    'litellm.utils',
    'litellm.caching',

-    # Textual TUI
-    'textual',
-    'textual.app',
-    'textual.widgets',
-    'textual.containers',
-    'textual.screen',
-    'textual.binding',
-    'textual.reactive',
-    'textual.css',
-    'textual._text_area_theme',
-
    # Rich console
    'rich',
    'rich.console',
@@ -118,28 +119,21 @@ hiddenimports = [
    'strix.interface.main',
    'strix.interface.cli',
    'strix.interface.tui',
-    'strix.interface.tui.app',
+    'strix.interface.tui.runtime',
    'strix.interface.tui.history',
    'strix.interface.tui.live_view',
-    'strix.interface.tui.messages',
-    'strix.interface.tui.renderers',
-    'strix.interface.tui.renderers.agent_message_renderer',
-    'strix.interface.tui.renderers.agents_graph_renderer',
-    'strix.interface.tui.renderers.base_renderer',
-    'strix.interface.tui.renderers.finish_renderer',
-    'strix.interface.tui.renderers.notes_renderer',
-    'strix.interface.tui.renderers.proxy_renderer',
-    'strix.interface.tui.renderers.registry',
-    'strix.interface.tui.renderers.reporting_renderer',
-    'strix.interface.tui.renderers.thinking_renderer',
-    'strix.interface.tui.renderers.todo_renderer',
-    'strix.interface.tui.renderers.user_message_renderer',
-    'strix.interface.tui.renderers.web_search_renderer',
+    'strix.interface.tui.backend',
+    'strix.interface.tui.backend.controller',
+    'strix.interface.tui.backend.messages',
+    'strix.interface.tui.backend.protocol',
+    'strix.interface.tui.backend.server',
    'strix.interface.utils',
    'strix.agents',
    'strix.agents.factory',
    'strix.agents.prompt',
-    'strix.config.models',
+    'strix.config.loader',
+    'strix.config.settings',
+    'strix.config.codex',
    'strix.core',
    'strix.core.agents',
    'strix.core.execution',
@@ -151,6 +145,21 @@ hiddenimports = [
    'strix.report.dedupe',
    'strix.report.state',
    'strix.report.writer',
+    'strix.interface.viewer',
+    'strix.interface.viewer.auth',
+    'strix.interface.viewer.cli',
+    'strix.interface.viewer.report_pdf',
+    'strix.interface.viewer.server',
+    'strix.interface.viewer.transcript',
+
+    # PDF report generation + encryption
+    'reportlab',
+    'reportlab.pdfgen',
+    'reportlab.pdfbase',
+    'reportlab.lib',
+    'reportlab.platypus',
+    'pypdf',
+    'cryptography',
    'strix.runtime',
    'strix.runtime.backends',
    'strix.runtime.caido_bootstrap',
@@ -174,10 +183,19 @@ hiddenimports = [
 ]

 hiddenimports += collect_submodules('litellm')
-hiddenimports += collect_submodules('textual')
 hiddenimports += collect_submodules('rich')
 hiddenimports += collect_submodules('pydantic')
 hiddenimports += collect_submodules('pygments')
+# reportlab loads renderers/fonts dynamically, so pull its whole tree in.
+hiddenimports += collect_submodules('reportlab')
+
+# reportlab ships bundled fonts (.pfb/.afm) it needs at runtime.
+datas += collect_data_files('reportlab')
+
+# reportlab imports PIL (pillow) lazily for image handling, so it must be
+# bundled explicitly and kept out of the excludes list below.
+hiddenimports += collect_submodules('PIL')
+datas += collect_data_files('PIL')

 excludes = [
    # Sandbox-only packages
@@ -225,19 +243,18 @@ excludes = [
    'numpy',
    'pandas',
    'scipy',
-    'PIL',
    'cv2',
 ]

 a = Analysis(
    ['strix/interface/main.py'],
    pathex=[str(project_root)],
-    binaries=[],
+    binaries=binaries,
    datas=datas,
    hiddenimports=hiddenimports,
    hookspath=[],
    hooksconfig={},
-    runtime_hooks=[],
+    runtime_hooks=[str(project_root / 'hooks' / 'rthooks' / 'pyi_rth_certifi.py')],
    excludes=excludes,
    noarchive=False,
    optimize=0,
@@ -16,13 +16,14 @@ from agents.tool import CustomTool, FunctionTool, Tool
 from pydantic import ValidationError

 from strix.agents.prompt import render_system_prompt
+from strix.config import load_settings
 from strix.tools.agents_graph.tools import (
    agent_finish,
    create_agent,
    send_message_to_agent,
    stop_agent,
    view_agent_graph,
-    wait_for_message,
+    wait_for_agents,
 )
 from strix.tools.finish.tool import finish_scan
 from strix.tools.load_skill.tool import load_skill
@@ -33,6 +34,7 @@ from strix.tools.notes.tools import (
    list_notes,
    update_note,
 )
+from strix.tools.output_store import bound_and_store, bound_text
 from strix.tools.proxy.tools import (
    list_requests,
    list_sitemap,
@@ -41,7 +43,13 @@ from strix.tools.proxy.tools import (
    view_request,
    view_sitemap_entry,
 )
-from strix.tools.reporting.tool import create_vulnerability_report
+from strix.tools.reporting.tool import (
+    create_dependency_report,
+    create_vulnerability_report,
+    get_report,
+    list_reports,
+)
+from strix.tools.respond.tool import respond_to_user
 from strix.tools.thinking.tool import think
 from strix.tools.todo.tools import (
    create_todo,
@@ -103,8 +111,113 @@ def _extract_custom_input(tool: CustomTool, raw_input: str | dict[str, Any]) ->
    return value if isinstance(value, str) else ""


+def _tool_output_limits() -> tuple[int, int]:
+    context = load_settings().context
+    return context.tool_output_max_lines, context.tool_output_max_bytes
+
+
+async def _bound_result(result: Any) -> Any:
+    if not isinstance(result, str):
+        return result
+    max_lines, max_bytes = _tool_output_limits()
+    return await bound_and_store(result, max_lines=max_lines, max_bytes=max_bytes)
+
+
 def _format_tool_error(exc: Exception) -> str:
-    return str(exc) or exc.__class__.__name__
+    message = str(exc) or exc.__class__.__name__
+    max_lines, max_bytes = _tool_output_limits()
+    return bound_text(message, max_lines=max_lines, max_bytes=max_bytes)
+
+
+def _with_bounded_result(tool: FunctionTool) -> FunctionTool:
+    """Cap a tool's result size before it enters history (idempotent)."""
+    if getattr(tool, "_strix_bounded", False):
+        return tool
+    invoke_tool = tool.on_invoke_tool
+
+    async def invoke(ctx: Any, raw_input: str) -> Any:
+        return await _bound_result(await invoke_tool(ctx, raw_input))
+
+    tool.on_invoke_tool = invoke
+    tool._strix_bounded = True  # type: ignore[attr-defined]
+    return tool
+
+
+def _schema_types(spec: dict[str, Any]) -> set[str]:
+    types: set[str] = set()
+    raw = spec.get("type")
+    if isinstance(raw, str):
+        types.add(raw)
+    elif isinstance(raw, list):
+        types.update(t for t in raw if isinstance(t, str))
+    for variant in spec.get("anyOf") or ():
+        if isinstance(variant, dict):
+            types |= _schema_types(variant)
+    types.discard("null")
+    return types
+
+
+def _decode_structured(value: str, types: set[str]) -> Any:
+    stripped = value.strip()
+    if not stripped:
+        return value
+    try:
+        decoded = json.loads(stripped)
+    except json.JSONDecodeError:
+        return value
+    wanted = list if "array" in types else dict
+    return decoded if isinstance(decoded, wanted) else value
+
+
+def _coerce_argument(value: Any, spec: dict[str, Any]) -> Any:
+    types = _schema_types(spec)
+    if not types or value is None:
+        return value
+    if isinstance(value, list | dict) and "string" in types and not types & {"array", "object"}:
+        return json.dumps(value, ensure_ascii=False)
+    if isinstance(value, str) and types & {"array", "object"} and "string" not in types:
+        return _decode_structured(value, types)
+    return value
+
+
+def _coerce_arguments(raw_input: str, schema: dict[str, Any]) -> str:
+    properties = schema.get("properties")
+    if not isinstance(properties, dict) or not properties:
+        return raw_input
+    try:
+        payload = json.loads(raw_input) if raw_input else None
+    except json.JSONDecodeError:
+        return raw_input
+    if not isinstance(payload, dict):
+        return raw_input
+
+    changed = False
+    for key, value in payload.items():
+        spec = properties.get(key)
+        if not isinstance(spec, dict):
+            continue
+        coerced = _coerce_argument(value, spec)
+        if coerced is not value:
+            payload[key] = coerced
+            changed = True
+
+    if not changed:
+        return raw_input
+    return json.dumps(payload, ensure_ascii=False)
+
+
+def _with_coerced_arguments(tool: FunctionTool) -> FunctionTool:
+    if getattr(tool, "_strix_coerced", False):
+        return tool
+    invoke_tool = tool.on_invoke_tool
+    schema = tool.params_json_schema
+
+    async def invoke(ctx: Any, raw_input: str) -> Any:
+        return await invoke_tool(ctx, _coerce_arguments(raw_input, schema))
+
+    tool.on_invoke_tool = invoke
+    tool._strix_coerced = True  # type: ignore[attr-defined]
+    return tool


 def _function_tool_with_error_result(tool: FunctionTool) -> FunctionTool:
@@ -112,7 +225,7 @@ def _function_tool_with_error_result(tool: FunctionTool) -> FunctionTool:

    async def invoke(ctx: Any, raw_input: str) -> Any:
        try:
-            return await invoke_tool(ctx, raw_input)
+            return await _bound_result(await invoke_tool(ctx, raw_input))
        except Exception as exc:  # noqa: BLE001 - tool errors should be model-visible results.
            logger.debug("Tool %s failed; returning error as result", tool.name, exc_info=True)
            return _format_tool_error(exc)
@@ -127,7 +240,7 @@ def _custom_tool_as_function_tool(tool: CustomTool) -> FunctionTool:
        if not custom_input:
            return f"`{_custom_tool_input_field(tool)}` must be a non-empty string."
        try:
-            return await tool.on_invoke_tool(ctx, custom_input)
+            return await _bound_result(await tool.on_invoke_tool(ctx, custom_input))
        except Exception as exc:  # noqa: BLE001 - matches SDK CustomTool error-as-result behavior.
            logger.debug("Tool %s failed; returning error as result", tool.name, exc_info=True)
            return _format_tool_error(exc)
@@ -159,12 +272,37 @@ def _custom_tool_as_function_tool(tool: CustomTool) -> FunctionTool:
    )


-def _configure_chat_completions_filesystem_tools(toolset: Any) -> None:
+def _bound_custom_tool(tool: CustomTool) -> CustomTool:
+    """Bound a native ``CustomTool`` result in place (Responses path)."""
+    invoke_tool = tool.on_invoke_tool
+
+    async def invoke(ctx: Any, raw_input: str) -> Any:
+        return await _bound_result(await invoke_tool(ctx, raw_input))
+
+    tool.on_invoke_tool = invoke
+    return tool
+
+
+def _configure_filesystem_tools(toolset: Any, *, chat_completions: bool) -> None:
    for name, tool in vars(toolset).items():
-        if isinstance(tool, CustomTool):
-            setattr(toolset, name, _custom_tool_as_function_tool(tool))
+        if chat_completions:
+            if isinstance(tool, CustomTool):
+                setattr(toolset, name, _custom_tool_as_function_tool(tool))
+            elif isinstance(tool, FunctionTool):
+                setattr(
+                    toolset, name, _function_tool_with_error_result(_with_coerced_arguments(tool))
+                )
+        elif isinstance(tool, CustomTool):
+            setattr(toolset, name, _bound_custom_tool(tool))
        elif isinstance(tool, FunctionTool):
-            setattr(toolset, name, _function_tool_with_error_result(tool))
+            setattr(toolset, name, _with_bounded_result(_with_coerced_arguments(tool)))
+
+
+def _make_filesystem_configurator(*, chat_completions: bool) -> Any:
+    def configure(toolset: Any) -> None:
+        _configure_filesystem_tools(toolset, chat_completions=chat_completions)
+
+    return configure


 _CHARS_ESCAPE_RE = re.compile(r"\\(?:u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|[0abtnvfr\\])")
@@ -205,10 +343,29 @@ def _format_validation_error(tool_name: str, exc: ValidationError) -> str:
    return f"{tool_name}: invalid arguments — " + "; ".join(parts)


+def _apply_shell_output_cap(parsed: dict[str, Any]) -> None:
+    """Clamp the SDK shell tools' ``max_output_tokens`` to the configured
+    ceiling; a smaller explicit value is respected."""
+    ceiling = load_settings().context.tool_output_max_tokens
+    requested = parsed.get("max_output_tokens")
+    parsed["max_output_tokens"] = (
+        ceiling if not isinstance(requested, int) or requested > ceiling else requested
+    )
+
+
 def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
    invoke_tool = tool.on_invoke_tool

    async def invoke(ctx: Any, raw_input: str) -> Any:
+        try:
+            parsed = json.loads(raw_input)
+        except (json.JSONDecodeError, TypeError):
+            parsed = None
+        if isinstance(parsed, dict):
+            if "shell" not in parsed:
+                parsed["shell"] = "bash"
+            _apply_shell_output_cap(parsed)
+            raw_input = json.dumps(parsed)
        try:
            return await invoke_tool(ctx, raw_input)
        except ValidationError as exc:
@@ -233,8 +390,10 @@ def _wrap_write_stdin(tool: FunctionTool) -> FunctionTool:
            parsed = json.loads(raw_input)
        except json.JSONDecodeError:
            parsed = None
-        if isinstance(parsed, dict) and isinstance(parsed.get("chars"), str):
-            parsed["chars"] = _decode_chars_escape(parsed["chars"])
+        if isinstance(parsed, dict):
+            if isinstance(parsed.get("chars"), str):
+                parsed["chars"] = _decode_chars_escape(parsed["chars"])
+            _apply_shell_output_cap(parsed)
            raw_input = json.dumps(parsed)
        try:
            return await invoke_tool(ctx, raw_input)
@@ -249,7 +408,7 @@ def _configure_shell_tools(toolset: Any, *, chat_completions: bool) -> None:
    for name, tool in vars(toolset).items():
        if not isinstance(tool, FunctionTool):
            continue
-        wrapped = tool
+        wrapped = _with_coerced_arguments(tool)
        if tool.name == "exec_command":
            wrapped = _wrap_exec_command(wrapped)
        elif tool.name == "write_stdin":
@@ -266,6 +425,10 @@ def _make_shell_configurator(*, chat_completions: bool) -> Any:
    return configure


+# Tools that hand control away by parking the agent rather than ending the scan.
+_PARKING_TOOLS: frozenset[str] = frozenset({"respond_to_user", "wait_for_agents"})
+
+
 def _lifecycle_tool_completed(tool_name: str, output: Any) -> bool:
    if tool_name == "agent_finish":
        completion_key = "agent_completed"
@@ -284,7 +447,7 @@ def _lifecycle_tool_completed(tool_name: str, output: Any) -> bool:


 def _wait_tool_parked(tool_name: str, output: Any) -> bool:
-    if tool_name != "wait_for_message" or not isinstance(output, str):
+    if tool_name not in _PARKING_TOOLS or not isinstance(output, str):
        return False
    try:
        parsed = json.loads(output)
@@ -335,6 +498,9 @@ _BASE_TOOLS: tuple[Tool, ...] = (
    delete_note,
    web_search,
    create_vulnerability_report,
+    create_dependency_report,
+    list_reports,
+    get_report,
    list_requests,
    view_request,
    repeat_request,
@@ -343,7 +509,7 @@ _BASE_TOOLS: tuple[Tool, ...] = (
    scope_rules,
    view_agent_graph,
    send_message_to_agent,
-    wait_for_message,
+    wait_for_agents,
    create_agent,
    stop_agent,
 )
@@ -393,7 +559,7 @@ def registered_agent_tools() -> tuple[Tool, ...]:

 def build_strix_agent(
    *,
-    name: str = "strix",
+    name: str = "agent",
    skills: list[str] | None = None,
    is_root: bool,
    scan_mode: str = "deep",
@@ -427,11 +593,20 @@ def build_strix_agent(
        )

    agent_tools = [*_EXTRA_TOOLS, *(extra_tools or [])]
+    if interactive:
+        # Yielding to the user is only meaningful when one is attached.
+        agent_tools.append(respond_to_user)
    if is_root:
        tools: list[Tool] = [*_BASE_TOOLS, *agent_tools, finish_scan]
    else:
        tools = [*_BASE_TOOLS, *agent_tools, agent_finish]
    _ensure_unique_tool_names(tools)
+    tools = [
+        _with_bounded_result(_with_coerced_arguments(tool))
+        if isinstance(tool, FunctionTool)
+        else tool
+        for tool in tools
+    ]

    logger.info(
        "Built %s agent '%s' (skills=%d, tools=%d, scan_mode=%s, whitebox=%s)",
@@ -451,8 +626,8 @@ def build_strix_agent(
        model=None,
        capabilities=[
            Filesystem(
-                configure_tools=(
-                    _configure_chat_completions_filesystem_tools if chat_completions_tools else None
+                configure_tools=_make_filesystem_configurator(
+                    chat_completions=chat_completions_tools,
                ),
            ),
            Shell(
@@ -91,6 +91,7 @@ def render_system_prompt(
            loaded_skill_names=list(skill_content.keys()),
            available_skills=get_available_skills(),
            interactive=interactive,
+            is_root=is_root,
            system_prompt_context=system_prompt_context or {},
            **skill_content,
        )
@@ -1,5 +1,14 @@
-You are Strix, an advanced AI application security validation agent developed by OmniSecure Labs. Your purpose is to perform authorized security verification, reproduce and validate weaknesses on in-scope assets, and help remediate real security issues.
+You are an advanced AI application security validation agent. Your purpose is to perform authorized security verification, reproduce and validate weaknesses on in-scope assets, and help remediate real security issues.
 You follow all instructions and rules provided to you exactly as written in the system prompt at all times.
+{% if is_root %}
+<root_agent_directive>
+YOU ARE THE ROOT AGENT. Your job is ORCHESTRATION, not hands-on testing.
+- You accomplish security work by DELEGATING to specialized subagents via create_agent — you do NOT run scanners, crawlers, fuzzers, or send exploit/injection payloads yourself.
+- IMPORTANT — how to read this prompt as root: the rest of this system prompt is written in the second person ("you") and describes the hands-on testing methodology (recon, mapping, scanning, payload spraying, PoC building, fixing). When you are the root agent, treat every such hands-on instruction as something you ensure gets done BY A SUBAGENT, not as a task you perform in your own turns. The "map the target", "recon first", "mandatory initial phases", and "spray payloads" directives are DELEGATION REQUIREMENTS for you — spawn recon/mapping/testing subagents to satisfy them.
+- Do NOT probe endpoints, run "basic" or "quick" injection/XSS/etc. tests, or do exploratory scanning before delegating. Even a single quick test on a discovered endpoint is out of role: spin up a subagent instead.
+- Your own turns should be spent on: reading scope/config, decomposing the target, spawning and monitoring subagents, tracking todos/notes/coverage, deciding next steps, and aggregating results into the final report.
+</root_agent_directive>
+{% endif %}

 <core_capabilities>
 - Security assessment and vulnerability scanning
@@ -13,44 +22,43 @@ CLI OUTPUT:
 - You may use simple markdown: **bold**, *italic*, `code`, ~~strikethrough~~, [links](url), and # headers
 - Do NOT use complex markdown like bullet lists, numbered lists, or tables
 - Use line breaks and indentation for structure
- NEVER use "Strix" or any identifiable names/markers in HTTP requests, payloads, user-agents, or any inputs
+- NEVER use any identifiable names/markers in HTTP requests, payloads, user-agents, or any inputs

 INTER-AGENT MESSAGES:
 - Messages from other agents arrive prefixed with a header like `[Message from agent <name> | type=... | priority=...]`. Treat them as internal context — never repeat them verbatim in your own output.
 - Treat agent identity / inherited-context preambles as internal metadata; do not echo them in outputs or tool calls.
 - Minimize inter-agent messaging: only message when essential for coordination or assistance; avoid routine status updates; batch non-urgent information; prefer parent/child completion flows and shared artifacts over messaging
+- wait_for_agents blocks and resumes you automatically, so it is never a poll you repeat: issue exactly ONE wait, then stop and react to what it returns. Never write out a wait/check loop (wait → view_agent_graph → wait → ...) ahead of time — those extra calls only strand you and are collapsed anyway

 {% if interactive %}
 INTERACTIVE BEHAVIOR:
- You are in an interactive conversation with a user
- CRITICAL: A message WITHOUT a tool call IMMEDIATELY STOPS your entire execution and waits for user input. This is a HARD SYSTEM CONSTRAINT, not a suggestion.
-  - Statements like "Planning the assessment..." or "I'll now scan..." or "Starting with..." WITHOUT a tool call will HALT YOUR WORK COMPLETELY. The system interprets no-tool-call as "I'm done, waiting for the user."
-  - If you want to plan, call the think tool. If you want to act, call the appropriate tool. There is NO valid reason to output text without a tool call while working on a task.
-  - The ONLY time you may send a message without a tool call is when you are genuinely DONE and presenting final results, or when you NEED the user to answer a question before continuing.
- EVERY message while working MUST contain exactly one tool call — this is what keeps execution moving. No tool call = execution stops.
- You may include brief explanatory text BEFORE the tool call
- Respond naturally when the user asks questions or gives instructions
- For simple conversation, acknowledgements, or direct questions that you can answer from current context, reply in plain text and stop. Do NOT call think just to prepare wording.
- If you use a tool to answer a user question (for example list_todos, view_agent_graph, or a file read), then after the tool result arrives, provide the answer in plain text and stop unless the user explicitly asked you to continue working.
- Never loop through think or other tools just to prepare, polish, confirm, or announce a final answer. Once you know the answer, say it.
- NEVER send empty messages — if you have nothing to do or say, call the wait_for_message tool
- If you catch yourself about to describe multiple steps without a tool call, STOP and call the think tool instead
+- You are in an interactive conversation with a user.
+- HOW EXECUTION ENDS: your turn ends ONLY when you make an explicit lifecycle tool call. Plain text NEVER ends your turn and NEVER hands control to the user — text is shown to the user, and then execution continues.
+  - To answer the user and hand control back, call respond_to_user. It delivers your message AND parks you for their reply in one call, so there is no way to answer and then forget to stop. This is the ONLY way to yield to the user.
+  - To wait on another AGENT (a child's report, a peer's reply), call wait_for_agents. That is not a way to reach the user.
+  - To end the whole engagement, call the lifecycle tool: finish_scan (root) or agent_finish (subagent).
+  - A turn that ends with plain text and no tool call does NOT stop you: the system nudges you to continue and will re-run you. Do not rely on going silent to pause — it will not pause you.
+- Answering a user question: put the answer in respond_to_user's message. Do not write the answer as plain text and then fall silent — that does not reach a stopping point, it just triggers a continuation nudge.
+- You may include brief explanatory text before a tool call, and you can narrate while you work — plain text is shown to the user as you go. Narrating is free; respond_to_user is specifically the act of WAITING for the user, so do not call it just to give a status update.
+- Respond naturally when the user asks questions or gives instructions.
+- While actively working on a task, every turn should carry exactly one tool call — use think to plan, the appropriate tool to act, and respond_to_user only when you genuinely need the user.
+- Never loop through think or other tools just to prepare, polish, confirm, or announce an answer. Once you know the answer, send it with respond_to_user.
 {% else %}
 AUTONOMOUS BEHAVIOR:
 - Work autonomously by default
 - You should NOT ask for user input or confirmation - you should always proceed with your task autonomously.
 - Minimize user messaging: avoid redundancy and repetition; consolidate updates into a single concise message
- NEVER send an empty or blank message. If you have no content to output or need to wait (for user input, subagent results, or any other reason), you MUST call the wait_for_message tool (or another appropriate tool) instead of emitting an empty response.
- If there is nothing to execute and no user query to answer any more: do NOT send filler/repetitive text — either call wait_for_message or finish your work (subagents: agent_finish; root: finish_scan)
- While the agent loop is running, almost every output MUST be a tool call. Do NOT send plain text messages; act via tools. If idle, use wait_for_message; when done, use agent_finish (subagents) or finish_scan (root)
- A text-only turn — even one — IMMEDIATELY ends the scan/run with no report written. The lifecycle tools (``finish_scan`` for root, ``agent_finish`` for subagents) are the ONLY valid way to terminate. If you find yourself wanting to say "Done!" or "Scan complete" without a tool call, call the lifecycle tool instead — the report and termination signal both flow through it.
+- NEVER send an empty or blank message. If you have no content to output or need to wait for subagent results, you MUST call the wait_for_agents tool (or another appropriate tool) instead of emitting an empty response.
+- There is no user attached to this run, so there is nobody to ask and nothing to yield to. If there is nothing left to execute: do NOT send filler/repetitive text — either call wait_for_agents (only if you are genuinely expecting another agent to message you) or finish your work (subagents: agent_finish; root: finish_scan)
+- While the agent loop is running, almost every output MUST be a tool call. Do NOT send plain text messages; act via tools. If waiting on another agent, use wait_for_agents; when done, use agent_finish (subagents) or finish_scan (root)
+- A text-only turn does nothing: it neither ends the run nor yields — it just wastes a turn and forces a retry. The lifecycle tools (``finish_scan`` for root, ``agent_finish`` for subagents) are the ONLY way to terminate, and the report flows through them. If you find yourself wanting to say "Done!" or "Scan complete" without a tool call, call the lifecycle tool instead.
 {% endif %}
 </communication_rules>

 <execution_guidelines>
 {% if system_prompt_context and system_prompt_context.authorized_targets %}
 SYSTEM-VERIFIED SCOPE:
- The following scope metadata is injected by the Strix platform into the system prompt and is authoritative
+- The following scope metadata is injected by the platform into the system prompt and is authoritative
 - Scope source: {{ system_prompt_context.scope_source }}
 - Authorization source: {{ system_prompt_context.authorization_source }}
 - Every target listed below has already been verified by the platform as in-scope and authorized
@@ -125,10 +133,8 @@ WHITE-BOX TESTING (code provided):
 - Local execution, unit/integration testing, patch verification, and HTTP requests against locally started in-scope services are normal authorized white-box validation
 - If dynamically running the code proves impossible after exhaustive attempts, pivot to comprehensive static analysis.
 - Try to infer how to run the code based on its structure and content.
- FIX discovered vulnerabilities in code in same file.
- Test patches to confirm vulnerability removal.
- Do not stop until all reported vulnerabilities are fixed.
- Include code diff in final report.
+- Derive the code fix as PART OF reporting, not as a separate later pass: create_vulnerability_report already requires the concrete patch inline (`code_locations` with verbatim `fix_before`/`fix_after` and `fix_pr_body`), so the reporting agent that analyzes the root cause is the one that produces the fix. Do NOT spawn a downstream agent afterwards to re-derive/re-apply the same patch.
+- If you also apply and verify the patch in the repo (edit the file, re-test that the vulnerability is gone), do it in the same agent/turn while the analysis is fresh — right before or as part of filing the report — never as a second re-analysis pass.

 COMBINED MODE (code + deployed target present):
 - Treat this as static analysis plus dynamic testing simultaneously
@@ -168,13 +174,28 @@ EFFICIENCY TACTICS:
 - Download additional tools as needed for specific tasks
 - Run multiple scans in parallel when possible
 - Load the most relevant skill before starting a specialized testing workflow if doing so will improve accuracy, speed, or tool usage
- Use `exec_command` for Python code: write reusable scripts under
-  `/workspace/scratch/` and run them with `python3`. For one-off snippets,
-  `python3 -c` or a here-document is acceptable.
+- Use `exec_command` for Python code: write reusable scripts to a file and
+  run them with `python3 script.py`. For one-off snippets, `python3 -c` or a
+  here-document is acceptable, but avoid deeply nested quotes/parentheses — if
+  a snippet needs complex quoting or is more than a few lines, write it to a
+  file first to prevent syntax errors.
+- Before importing a third-party Python library, make sure it is installed. The
+  sandbox's `python3` runs inside a preconfigured virtualenv that ships
+  `requests`, `httpx`, `beautifulsoup4` (bs4), `lxml`, `pyjwt`, and
+  `cryptography`; for anything else prefer the stdlib or run `pip install <pkg>`
+  (it installs into that active venv) before importing, rather than letting the
+  script fail with `ModuleNotFoundError`.
+- `exec_command` runs each command in a fresh non-interactive shell (plain
+  pipes, no TTY). To drive an interactive or long-running process with
+  `write_stdin` — REPLs, `ssh`/`nc`/`ftp`, `sqlmap`, or to send Ctrl-C —
+  you MUST start it with `exec_command(cmd="...", tty=true)` and then
+  `write_stdin(session_id=<id>, chars="...")`. Calling `write_stdin` on a
+  default (non-TTY) command or on a process that has already exited fails with
+  "stdin is not available".
 - For Caido proxy automation inside Python, explicitly import from
  `caido_api`:
  `from caido_api import list_requests, view_request, repeat_request, list_sitemap, view_sitemap_entry, scope_rules`
- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, zaproxy, nuclei, wapiti, arjun, httpx, katana, semgrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
+- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, semgrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
 - For trial-heavy vectors (SQLi, XSS, XXE, SSRF, RCE, auth/JWT, deserialization), DO NOT iterate payloads manually in the browser. Always spray payloads via Python scripts through `exec_command` or terminal tools.
 - When using established fuzzers/scanners, use the proxy for inspection where helpful
 - Generate/adapt large payload corpora: combine encodings (URL, unicode, base64), comment styles, wrappers, time-based/differential probes. Expand with wordlists/templates
@@ -186,13 +207,17 @@ EFFICIENCY TACTICS:
 VALIDATION REQUIREMENTS:
 - Full validation required - no assumptions
 - Demonstrate concrete impact with evidence
- Consider business context for severity assessment
+- Consider business context for severity assessment — check whether the target is a demo/sandbox environment or content meant to be public, and factor that in
+- Score only the security impact demonstrated by the proof of concept. Reachability, missing authentication, scanner labels, and theoretical follow-on attacks do not by themselves justify non-None CVSS impact metrics
+- Treat public metadata, internal-looking identifiers, source maps without secrets, and transport/configuration hygiene as observations unless validation proves unauthorized restricted-data access, modification, or service disruption
+- Every non-None Confidentiality, Integrity, or Availability metric must map to explicit evidence in the report; use Scope Changed only for a demonstrated crossing of security authorities
 - Independent verification through subagent
 - Document complete attack chain
 - Keep going until you find something that matters
- A vulnerability is ONLY considered reported when a reporting agent uses create_vulnerability_report with full details. Mentions in agent_finish, finish_scan, or generic messages are NOT sufficient
- Do NOT patch/fix before reporting: first create the vulnerability report via create_vulnerability_report (by the reporting agent). Only after reporting is completed should fixing/patching proceed
+- A vulnerability is ONLY considered reported when a reporting agent uses create_vulnerability_report (or create_dependency_report for known-CVE dependency/supply-chain findings) with full details. Mentions in agent_finish, finish_scan, or generic messages are NOT sufficient
+- Reporting and fixing are ONE step, not two: when source is available, the reporting agent derives the concrete fix and files it INLINE via create_vulnerability_report (`code_locations` with `fix_before`/`fix_after` + `fix_pr_body`) — the report is not complete without it. Do NOT report first and then spawn a separate downstream agent to re-derive and re-apply the same patch; that just re-does the analysis and wastes tokens. (Do not silently patch a finding WITHOUT filing a report — the report, with its embedded fix, is the deliverable.)
 - DEDUPLICATION: The create_vulnerability_report tool uses LLM-based deduplication. If it rejects your report as a duplicate, DO NOT attempt to re-submit the same vulnerability. Accept the rejection and move on to testing other areas. The vulnerability has already been reported by another agent
+- REVIEWING FILED FINDINGS (orchestrator/root agent): use list_reports to see every vulnerability filed so far in this scan (by any agent, root or child) — metadata-first with per-severity counts — and get_report to read one finding in full by its id. These are read-only orchestration tools: the root agent uses them to track coverage, avoid dispatching work on already-covered ground, assemble the finish_scan executive summary, and reason about attack-chaining across confirmed findings. Leaf/specialist agents should NOT call them — just do your assigned testing and file findings. Each entry shows which agent filed it (agent_name), and your own entries are flagged by_you. list_notes/get_note do the same for notes.
 </execution_guidelines>

 <vulnerability_focus>
@@ -240,12 +265,20 @@ AGENT ISOLATION & SANDBOXING:
 - All agents share the same /workspace directory and proxy history
 - Agents can see each other's files and proxy traffic for better collaboration

-MANDATORY INITIAL PHASES:
+DISK & SCRATCH HYGIENE:
+- /workspace is a shared, finite disk used by all agents at once — be a considerate tenant
+- Prefer bounded recon: scope crawls and scans by depth, duration, and target rather than "collect everything"
+- Redirect large tool output to a file, and once you've extracted what you need (e.g. a URL/endpoint list), remove the raw output
+- If disk gets tight or a write fails for space, check what's large under /workspace and clean up files from your own task; leave another agent's files unless you've confirmed they're no longer in use

+MANDATORY INITIAL PHASES:
+{% if is_root %}
+- ROOT AGENT: these phases are mandatory for the assessment, but you MUST accomplish them by delegating to reconnaissance/mapping subagents — do NOT run recon, crawling, enumeration, or mapping tools in your own turns. Spawn the appropriate subagent(s) and track their coverage.
+{% endif %}
 BLACK-BOX TESTING - PHASE 1 (RECON & MAPPING):
 - COMPLETE full reconnaissance: subdomain enumeration, port scanning, service detection
 - MAP entire attack surface: all endpoints, parameters, APIs, forms, inputs
- CRAWL thoroughly: spider all pages (authenticated and unauthenticated), discover hidden paths, analyze JS files
+- CRAWL thoroughly: spider all pages (authenticated and unauthenticated), discover hidden paths, analyze JS files — keep each crawl bounded by depth/duration, and tidy up raw output once endpoints are extracted
 - ENUMERATE technologies: frameworks, libraries, versions, dependencies
 - Reconnaissance should normally happen before targeted vulnerability discovery unless the correct next move is already obvious or the user/system explicitly asks to prioritize a specific area first
 - ONLY AFTER comprehensive mapping → proceed to vulnerability testing
@@ -270,13 +303,14 @@ ROOT AGENT ROLE:
 - The root agent should coordinate strategy, delegate meaningful work, track progress, maintain todo lists, maintain notes, monitor subagent results, and decide next steps
 - The root agent should keep a clear view of overall coverage, uncovered attack surfaces, validation status, and reporting/fixing progress
 - The root agent should avoid spending its own iterations on detailed testing, payload execution, or deep target-specific investigation when that work can be delegated to specialized subagents
- The root agent may do lightweight triage, quick verification, or setup work when necessary to unblock delegation, but its default mode should be coordinator/controller
+- The root agent may do orchestration-support work needed to delegate well — reading scope/config, inspecting workspace layout, reading subagent output/reports, and light bookkeeping. It must NOT do the actual security testing itself: no running scanners/fuzzers/crawlers, no sending injection/XSS/SSRF/etc. payloads, and no "basic" or "quick" probing of discovered endpoints. If a check requires touching the target, delegate it to a subagent rather than doing it yourself
+- Its default and near-exclusive mode is coordinator/controller
 - Subagents should do the substantive testing, validation, reporting, and fixing work
 - The root agent is responsible for ensuring that work is broken down clearly, tracked, and completed across the agent tree

 1. **CREATE AGENTS SELECTIVELY** - Spawn subagents when delegation materially improves parallelism, specialization, coverage, or independent validation. Deeper delegation is allowed when the child has a meaningfully different responsibility from the parent. Do not spawn subagents for trivial continuation of the same narrow task.
 2. **BLACK-BOX**: Discovery → Validation → Reporting (3 agents per vulnerability)
-3. **WHITE-BOX**: Discovery → Validation → Reporting → Fixing (4 agents per vulnerability)
+3. **WHITE-BOX**: Discovery → Validation → Reporting-with-fix (3 agents per vulnerability — the reporting agent derives and files the fix inline; do NOT add a separate fixing agent that re-derives the same patch)
 4. **MULTIPLE VULNS = MULTIPLE CHAINS** - Each vulnerability finding gets its own validation chain
 5. **CREATE AGENTS AS YOU GO** - Don't create all agents at start, create them when you discover new attack surfaces
 6. **ONE JOB PER AGENT** - Each agent has ONE specific task only
@@ -295,8 +329,7 @@ BLACK-BOX (domain/URL only):
 WHITE-BOX (source code provided):
 - Found authentication code issues? → Create authentication analysis agent
 - Auth agent finds potential vulnerability? → Create "Auth Validation Agent"
- Validation agent confirms vulnerability? → Create "Auth Reporting Agent"
- Reporting agent documents vulnerability? → Create "Auth Fixing Agent" (implement code fix and test it works)
+- Validation agent confirms vulnerability? → Create "Auth Reporting Agent" that files the report AND its inline fix (`code_locations` + `fix_pr_body`) in one shot — no separate fixing agent

 VULNERABILITY WORKFLOW (MANDATORY FOR EVERY FINDING):

@@ -317,9 +350,11 @@ Authentication Code Agent finds weak password validation
    ↓
 Spawns "Auth Validation Agent" (proves it's exploitable)
    ↓
-If valid → Spawns "Auth Reporting Agent" (creates vulnerability report)
+If valid → Spawns "Auth Reporting Agent" (creates the vulnerability report
+           WITH the fix inline: code_locations fix_before/fix_after + fix_pr_body,
+           applying/verifying the patch in the same turn if desired)
    ↓
-Spawns "Auth Fixing Agent" (implements secure code fix)
+STOP - no separate fixing agent; the fix was derived once, at report time
 ```

 CRITICAL RULES:
@@ -355,7 +390,7 @@ FOCUS PRINCIPLES:
 REALISTIC TESTING OUTCOMES:
 - **No Findings**: Agent completes testing but finds no vulnerabilities
 - **Validation Failed**: Initial finding was false positive, validation agent confirms it's not exploitable
- **Valid Vulnerability**: Validation succeeds, spawns reporting agent and then fixing agent (white-box)
+- **Valid Vulnerability**: Validation succeeds, spawns a reporting agent that files the report with the fix inline (white-box) — no separate fixing agent

 PERSISTENCE IS MANDATORY:
 - Real vulnerabilities take TIME - expect to need 2000+ steps minimum
@@ -380,7 +415,6 @@ VULNERABILITY ASSESSMENT:
 - nuclei - Vulnerability scanner with templates
 - sqlmap - SQL injection detection/exploitation
 - trivy - Container/dependency vulnerability scanner
- zaproxy - OWASP ZAP web app scanner
 - wapiti - Web vulnerability scanner

 WEB FUZZING & DISCOVERY:
@@ -413,14 +447,26 @@ SPECIALIZED TOOLS:
 PROXY & INTERCEPTION:
 - Caido CLI - Modern web proxy (already running). Use the proxy tools
  directly, or import `caido_api` from sandbox Python scripts.
- NOTE: If you are seeing proxy errors when sending requests, it usually means you are not sending requests to a correct url/host/port.
- Ignore Caido proxy-generated 50x HTML error pages; these are proxy issues (might happen when requesting a wrong host or SSL/TLS issues, etc).
+- HTTPQL filters (for `list_requests`): quote string values, leave integers unquoted (`resp.code.eq:200`, not `"200"`); combine terms with `AND`/`OR` (there is no `NOT` — use the negated operator `ne`/`ncont`/`nregex`). Numeric fields (`resp.code`, `req.port`) use `eq`/`ne`/`gt`/`gte`/`lt`/`lte`; text fields (`req.host`, `req.path`, `req.method`, `req.raw`) use `cont`/`ncont`/`eq`/`regex`. Example: `resp.code.gte:200 AND resp.code.lt:300 AND req.host.cont:"api"`.
+
+CAIDO PROXY ERROR PAGES — NOT RESPONSES FROM THE TARGET:
+Everything is proxied through Caido, so an unreachable target makes the *proxy* answer: a ~9KB
+`<title>Caido</title>` HTML page under 502/500, which curl/python/browser print as if it were the
+target's content. The request never reached a server. It also appears in `list_requests` with no
+response at all (`resp` null), unlike a real 502.
+- Don't dump it; extract the cause with `curl -s ... | grep -A8 'c-title"'`.
+- The `c-details` cause says what to fix: "Failed to query DNS" — host doesn't resolve, check
+  `dig +short <host>`, then correct or drop it; "Connection refused" — nothing on that port, check
+  `nc -z -v <host> <port>`; "TLS handshake"/"wrong version number" — scheme/port mismatch, flip
+  http/https; timeout — filtered or unreachable from the sandbox.
+- NEVER treat these as target behavior: not a finding, not evidence, not a WAF, not a server
+  error. Fix the url/host/port/scheme and retry, or move on — do not keep re-requesting a dead host.

 PROGRAMMING:
- Python 3, uv, Go, Node.js/npm
+- Python 3, uv, Node.js/npm
 - Full development environment
 - Docker is NOT available inside the sandbox. Do not run docker; rely on provided tools to run locally.
- You can install any additional tools/packages needed based on the task/context using package managers (apt, pip, npm, go install, etc.)
+- You can install any additional tools/packages needed based on the task/context using package managers (apt, pip, npm, etc.)

 Directories:
 - /workspace - where you should work.
@@ -444,8 +490,10 @@ Default user: pentester (sudo available)
 <available_skills>
 On-demand specialist skills. Spawn a specialist via `create_agent(skills=[...])`, or pull guidance inline for yourself via `load_skill(skills=[...])`. Anything wrapped in `<specialized_knowledge>` above is already loaded for you.

-{% for category, names in available_skills | dictsort -%}
- {{ category }}: {{ names | join(', ') }}
+{% for category, skills in available_skills | dictsort -%}
+{% for skill in skills -%}
+- {{ category }}/{{ skill.name }}{% if skill.description %}: {{ skill.description }}{% endif %}
+{% endfor -%}
 {% endfor -%}
 </available_skills>
 {% endif %}
@@ -17,6 +17,8 @@ from strix.config.loader import (
    persist_current,
 )
 from strix.config.settings import (
+    ContextSettings,
+    DedupeSettings,
    IntegrationSettings,
    LlmSettings,
    RuntimeSettings,
@@ -26,6 +28,8 @@ from strix.config.settings import (


 __all__ = [
+    "ContextSettings",
+    "DedupeSettings",
    "IntegrationSettings",
    "LlmSettings",
    "RuntimeSettings",
@@ -0,0 +1,403 @@
+"""ChatGPT (Codex) subscription auth: OAuth login, token refresh, and the OpenAI
+client that routes inference through the ChatGPT backend.
+
+Mirrors OpenAI's Codex CLI: OAuth 2.0 + PKCE against ``auth.openai.com``, with the
+access token sent as a ``Bearer`` token to ``chatgpt.com/backend-api/codex``. Using
+a ChatGPT subscription outside OpenAI's own products is not officially supported by
+OpenAI; the user chooses this path knowingly. The OAuth constants are OpenAI's own
+Codex CLI values (the backend only accepts that client).
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import hashlib
+import json
+import logging
+import secrets
+import threading
+import time
+import urllib.parse
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+import requests
+
+from strix.utils.secret_files import write_secret_text
+
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from openai import AsyncOpenAI
+
+
+logger = logging.getLogger(__name__)
+
+
+PROVIDER = "codex"
+
+CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize"
+TOKEN_URL = "https://auth.openai.com/oauth/token"  # noqa: S105  # nosec B105 - URL, not a secret
+CALLBACK_HOST = "localhost"
+CALLBACK_PORT = 1455
+CALLBACK_PATH = "/auth/callback"
+REDIRECT_URI = f"http://{CALLBACK_HOST}:{CALLBACK_PORT}{CALLBACK_PATH}"
+SCOPE = "openid profile email offline_access"
+
+CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex"
+ORIGINATOR = "codex_cli_rs"
+_ACCOUNT_CLAIM = "https://api.openai.com/auth"
+
+_TOKEN_TIMEOUT = 30
+_EXPIRY_SKEW_S = 300
+
+_refresh_lock = threading.Lock()
+
+# Kept separate from cli-config.json so OAuth tokens never land in the env-var config.
+AUTH_PATH = Path.home() / ".strix" / "subscription-auth.json"
+
+
+def _read_store() -> dict[str, Any]:
+    try:
+        data = json.loads(AUTH_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _write_store(data: dict[str, Any]) -> None:
+    write_secret_text(AUTH_PATH, json.dumps(data, indent=2))
+
+
+def read_record() -> dict[str, Any] | None:
+    record = _read_store().get(PROVIDER)
+    if not isinstance(record, dict) or record.get("type") != "oauth":
+        return None
+    if not (record.get("access") and record.get("refresh") and record.get("account_id")):
+        return None
+    return record
+
+
+def is_authenticated() -> bool:
+    return read_record() is not None
+
+
+def save_record(record: dict[str, Any]) -> None:
+    data = _read_store()
+    data[PROVIDER] = record
+    _write_store(data)
+
+
+def logout() -> None:
+    data = _read_store()
+    if PROVIDER not in data:
+        return
+    del data[PROVIDER]
+    if data:
+        _write_store(data)
+        return
+    with contextlib.suppress(OSError):
+        AUTH_PATH.unlink()
+
+
+@contextlib.contextmanager
+def _refresh_guard() -> Iterator[None]:
+    """Serialize token refresh within (lock) and across (flock) Strix processes,
+    so concurrent runs can't both spend the single-use refresh token."""
+    with _refresh_lock:
+        try:
+            import fcntl
+
+            lock_path = AUTH_PATH.with_suffix(".lock")
+            lock_path.parent.mkdir(parents=True, exist_ok=True)
+            handle = lock_path.open("w")
+        except (ImportError, OSError):
+            yield
+            return
+        try:
+            with contextlib.suppress(OSError):
+                fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            yield
+        finally:
+            with contextlib.suppress(OSError):
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+            handle.close()
+
+
+class CodexAuthError(Exception):
+    def __init__(self, code: str, message: str | None = None) -> None:
+        self.code = code
+        super().__init__(message or code)
+
+
+class CodexContentGuardrailError(Exception):
+    """The ChatGPT backend refused a request via its content guardrail.
+    Terminal — retrying identical content never clears the block."""
+
+    def __init__(self, model: str, original: BaseException | None = None) -> None:
+        self.model = model
+        self.original = original
+        super().__init__(
+            f"'{model}' was blocked by ChatGPT's content guardrails "
+            f"(flagged as a possible cybersecurity risk). "
+            f"Set STRIX_LLM to a model that isn't blocked and re-run."
+        )
+
+
+_GUARDRAIL_MARKERS = (
+    "flagged for possible cybersecurity risk",
+    "trusted access for cyber",
+)
+
+
+def is_content_guardrail_error(exc: BaseException) -> bool:
+    if isinstance(exc, CodexContentGuardrailError):
+        return True
+    text = str(exc).lower()
+    return any(marker in text for marker in _GUARDRAIL_MARKERS)
+
+
+def _b64url(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+
+def generate_pkce() -> tuple[str, str]:
+    verifier = _b64url(secrets.token_bytes(64))
+    challenge = _b64url(hashlib.sha256(verifier.encode("ascii")).digest())
+    return verifier, challenge
+
+
+def create_state() -> str:
+    return secrets.token_hex(16)
+
+
+def build_authorize_url(challenge: str, state: str) -> str:
+    params = {
+        "response_type": "code",
+        "client_id": CLIENT_ID,
+        "redirect_uri": REDIRECT_URI,
+        "scope": SCOPE,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+        "state": state,
+        "id_token_add_organizations": "true",
+        "codex_cli_simplified_flow": "true",
+        "originator": ORIGINATOR,
+    }
+    return f"{AUTHORIZE_URL}?{urllib.parse.urlencode(params)}"
+
+
+def parse_redirect_input(value: str) -> tuple[str | None, str | None]:
+    """Extract ``(code, state)`` from a pasted redirect URL, ``code#state``,
+    query string, or bare code."""
+    value = (value or "").strip()
+    if not value:
+        return None, None
+    with contextlib.suppress(ValueError):
+        parsed = urllib.parse.urlparse(value)
+        if parsed.scheme and parsed.query:
+            query = urllib.parse.parse_qs(parsed.query)
+            return _first(query, "code"), _first(query, "state")
+    if "#" in value:
+        code, _, state = value.partition("#")
+        return code or None, state or None
+    if "code=" in value:
+        query = urllib.parse.parse_qs(value)
+        return _first(query, "code"), _first(query, "state")
+    return value, None
+
+
+def _first(query: dict[str, list[str]], key: str) -> str | None:
+    values = query.get(key)
+    return values[0] if values else None
+
+
+def _post_form(payload: dict[str, str]) -> dict[str, Any]:
+    detail = ""
+    try:
+        with requests.post(
+            TOKEN_URL,
+            data=payload,
+            headers={"Accept": "application/json"},
+            timeout=_TOKEN_TIMEOUT,
+        ) as response:
+            status_code = response.status_code
+            body = response.content
+            if status_code >= 400:
+                detail = response.text[:300]
+    except requests.RequestException as exc:
+        raise CodexAuthError("unavailable", str(exc)) from exc
+    if status_code >= 400:
+        raise CodexAuthError("token_http_error", f"HTTP {status_code}: {detail}")
+    data = json.loads(body or b"{}")
+    if not isinstance(data, dict):
+        raise CodexAuthError("bad_response", "token endpoint returned non-object")
+    return data
+
+
+def _record_from_token_response(
+    data: dict[str, Any], refresh_fallback: str | None = None
+) -> dict[str, Any]:
+    access = data.get("access_token")
+    # A refresh response may omit refresh_token when it isn't rotated; keep the old one.
+    refresh = data.get("refresh_token") or refresh_fallback
+    expires_in = data.get("expires_in")
+    if not isinstance(access, str) or not access:
+        raise CodexAuthError("bad_response", "token response missing access_token")
+    if not isinstance(refresh, str) or not refresh:
+        raise CodexAuthError("bad_response", "token response missing refresh_token")
+    account_id = _account_id_from_jwt(access) or _account_id_from_jwt(
+        data.get("id_token") if isinstance(data.get("id_token"), str) else ""
+    )
+    if not account_id:
+        raise CodexAuthError("no_account_id", "could not read chatgpt_account_id from token")
+    ttl = expires_in if isinstance(expires_in, int | float) else 3600
+    return {
+        "type": "oauth",
+        "provider": PROVIDER,
+        "access": access,
+        "refresh": refresh,
+        "account_id": account_id,
+        "expires_at": time.time() + ttl,
+    }
+
+
+def exchange_code(code: str, verifier: str) -> dict[str, Any]:
+    data = _post_form(
+        {
+            "grant_type": "authorization_code",
+            "client_id": CLIENT_ID,
+            "code": code,
+            "code_verifier": verifier,
+            "redirect_uri": REDIRECT_URI,
+        }
+    )
+    return _record_from_token_response(data)
+
+
+def refresh_tokens(refresh_token: str) -> dict[str, Any]:
+    data = _post_form(
+        {
+            "grant_type": "refresh_token",
+            "client_id": CLIENT_ID,
+            "refresh_token": refresh_token,
+        }
+    )
+    return _record_from_token_response(data, refresh_fallback=refresh_token)
+
+
+def _account_id_from_jwt(token: str | None) -> str | None:
+    """Read the account id claim without verifying the JWT (the server enforces
+    authenticity on use); it feeds the ``chatgpt-account-id`` header."""
+    if not token or token.count(".") != 2:
+        return None
+    payload_b64 = token.split(".")[1]
+    padding = "=" * (-len(payload_b64) % 4)
+    try:
+        payload = json.loads(base64.urlsafe_b64decode(payload_b64 + padding))
+    except (ValueError, json.JSONDecodeError):
+        return None
+    if not isinstance(payload, dict):
+        return None
+    auth = payload.get(_ACCOUNT_CLAIM)
+    if isinstance(auth, dict):
+        account_id = auth.get("chatgpt_account_id")
+        if isinstance(account_id, str) and account_id:
+            return account_id
+    organizations = payload.get("organizations")
+    if isinstance(organizations, list) and organizations and isinstance(organizations[0], dict):
+        org_id = organizations[0].get("id")
+        if isinstance(org_id, str) and org_id:
+            return org_id
+    return None
+
+
+def _near_expiry(record: dict[str, Any]) -> bool:
+    expires_at = record.get("expires_at")
+    if not isinstance(expires_at, int | float):
+        return True
+    return expires_at - _EXPIRY_SKEW_S <= time.time()
+
+
+def get_valid_token() -> tuple[str, str]:
+    """Return ``(access_token, account_id)``, refreshing under the cross-process
+    guard if near expiry."""
+    record = read_record()
+    if record is None:
+        raise CodexAuthError("not_authenticated", "not signed in; run: strix auth login")
+    if not _near_expiry(record):
+        return record["access"], record["account_id"]
+    with _refresh_guard():
+        record = read_record()
+        if record is None:
+            raise CodexAuthError("not_authenticated", "not signed in; run: strix auth login")
+        if not _near_expiry(record):
+            return record["access"], record["account_id"]
+        try:
+            refreshed = refresh_tokens(record["refresh"])
+        except CodexAuthError:
+            # A peer process may have already spent this single-use refresh token.
+            latest = read_record()
+            if latest and latest["refresh"] != record["refresh"] and not _near_expiry(latest):
+                return latest["access"], latest["account_id"]
+            raise
+        save_record(refreshed)
+        return refreshed["access"], refreshed["account_id"]
+
+
+def build_openai_client() -> AsyncOpenAI:
+    """An ``AsyncOpenAI`` for the ChatGPT backend. A per-request hook re-stamps a
+    fresh bearer token so long scans survive token expiry."""
+    import asyncio
+
+    import httpx
+    from openai import AsyncOpenAI
+
+    get_valid_token()  # fail fast at configure time if the sign-in is dead
+
+    async def _auth_hook(request: httpx.Request) -> None:
+        access, account_id = await asyncio.to_thread(get_valid_token)
+        request.headers["Authorization"] = f"Bearer {access}"
+        request.headers["chatgpt-account-id"] = account_id
+
+    http_client = httpx.AsyncClient(
+        timeout=httpx.Timeout(600.0, connect=30.0),
+        event_hooks={"request": [_auth_hook]},
+    )
+    return AsyncOpenAI(
+        api_key="strix-codex-oauth",  # placeholder; the hook overwrites Authorization
+        base_url=CODEX_BASE_URL,
+        http_client=http_client,
+        default_headers={
+            "OpenAI-Beta": "responses=experimental",
+            "originator": ORIGINATOR,
+        },
+    )
+
+
+_subscription_client: AsyncOpenAI | None = None
+
+
+def get_subscription_client() -> AsyncOpenAI:
+    global _subscription_client  # noqa: PLW0603
+    if _subscription_client is None:
+        _subscription_client = build_openai_client()
+    return _subscription_client
+
+
+SUBSCRIPTION_PREFIX = "chatgpt/"
+
+
+def subscription_model(model_name: str | None) -> str | None:
+    """The model slug behind a ``chatgpt/<model>`` STRIX_LLM, or None."""
+    name = (model_name or "").strip()
+    if not name.lower().startswith(SUBSCRIPTION_PREFIX):
+        return None
+    return name[len(SUBSCRIPTION_PREFIX) :] or None
+
+
+def auth_mode(model_name: str | None) -> str:
+    return "subscription" if subscription_model(model_name) else "api_key"
@@ -2,7 +2,6 @@

 from __future__ import annotations

-import contextlib
 import json
 import logging
 import os
@@ -12,6 +11,7 @@ from typing import TYPE_CHECKING, Any
 from pydantic import AliasChoices, BaseModel

 from strix.config.settings import Settings
+from strix.utils.secret_files import write_secret_text


 if TYPE_CHECKING:
@@ -71,9 +71,7 @@ def persist_current() -> None:
                    env_block[alias.upper()] = value
                    break

-    target.write_text(json.dumps({"env": env_block}, indent=2), encoding="utf-8")
-    with contextlib.suppress(OSError):
-        target.chmod(0o600)
+    write_secret_text(target, json.dumps({"env": env_block}, indent=2))


 def _aliases_for(finfo: FieldInfo) -> list[str]:
@@ -2,22 +2,447 @@

 from __future__ import annotations

+import asyncio
+import contextlib
+import inspect
+import logging
 import os
-from typing import TYPE_CHECKING
+import time
+from collections.abc import AsyncGenerator
+from typing import TYPE_CHECKING, Any, cast

-from agents import set_default_openai_api, set_default_openai_key, set_tracing_disabled
+from agents import (
+    set_default_openai_api,
+    set_default_openai_key,
+    set_tracing_disabled,
+)
+from agents.model_settings import ModelSettings
+from agents.models.fake_id import FAKE_RESPONSES_ID
+from agents.models.interface import Model
 from agents.models.multi_provider import MultiProvider
+from agents.models.openai_responses import OpenAIResponsesModel
 from agents.retry import (
    ModelRetryBackoffSettings,
    ModelRetrySettings,
+    RetryPolicyContext,
    retry_policies,
 )
+from openai.types.responses import (
+    Response,
+    ResponseCompletedEvent,
+    ResponseOutputItemAddedEvent,
+    ResponseOutputItemDoneEvent,
+)
+from openai.types.responses.response_usage import ResponseUsage
+from openai.types.shared import Reasoning
+
+from strix.config import codex
+from strix.config.loader import load_settings
+from strix.config.tool_call_ids import TurnCallIdRewriter, dedupe_input
+from strix.config.tool_call_limits import TurnToolCallLimiter


 if TYPE_CHECKING:
-    from agents.models.interface import ModelProvider
+    from collections.abc import AsyncIterator

-    from strix.config.settings import Settings
+    from agents.agent_output import AgentOutputSchemaBase
+    from agents.handoffs import Handoff
+    from agents.items import ModelResponse, TResponseInputItem, TResponseStreamEvent
+    from agents.models.interface import ModelProvider, ModelTracing
+    from agents.retry import ModelRetryAdvice, ModelRetryAdviceRequest
+    from agents.tool import Tool
+    from agents.usage import Usage
+    from openai import AsyncOpenAI
+    from openai.types.responses.response_prompt_param import ResponsePromptParam
+
+    from strix.config.settings import LlmSettings, ReasoningEffort, Settings
+
+
+logger = logging.getLogger(__name__)
+
+
+def request_timeout_extra_args(timeout_s: float | None) -> dict[str, float] | None:
+    """Per-request model timeout; a plain float so ``ModelSettings.to_json_dict()`` stays serializable."""  # noqa: E501
+    if not timeout_s or timeout_s <= 0:
+        return None
+    return {"timeout": timeout_s}
+
+
+def _retry_statusless_provider_errors(context: RetryPolicyContext) -> bool:
+    """Retry statusless provider errors (e.g. mid-stream quota/billing), but not aborts."""
+    normalized = context.normalized
+    if normalized.is_abort:
+        return False
+    if codex.is_content_guardrail_error(context.error):
+        return False
+    return normalized.status_code is None
+
+
+class _CodexResponsesModel(OpenAIResponsesModel):
+    """Responses model for the ChatGPT subscription backend (always streamed, stateless)."""
+
+    def __init__(
+        self,
+        model: str,
+        openai_client: AsyncOpenAI,
+        *,
+        reasoning_effort: ReasoningEffort | None = None,
+    ) -> None:
+        super().__init__(model, openai_client)
+        self._reasoning_effort = reasoning_effort
+
+    def _codex_settings(self, model_settings: ModelSettings) -> ModelSettings:
+        overrides = ModelSettings(store=False, response_include=["reasoning.encrypted_content"])
+        effort = self._reasoning_effort
+        if effort and effort != "none":
+            # Clamp to efforts the backend accepts.
+            match effort:
+                case "minimal":
+                    effort = "low"
+                case "xhigh" | "max":
+                    effort = "high"
+                case _:
+                    pass
+            overrides = overrides.resolve(ModelSettings(reasoning=Reasoning(effort=effort)))
+        return model_settings.resolve(overrides)
+
+    async def _fetch_response(self, *args: Any, stream: bool = False, **kwargs: Any) -> Any:
+        if len(args) >= 3:  # model_settings is positional arg 2
+            args = (*args[:2], self._codex_settings(args[2]), *args[3:])
+        try:
+            events = await super()._fetch_response(*args, stream=True, **kwargs)  # type: ignore[call-overload]
+        except Exception as exc:
+            guardrail = self._as_guardrail(exc)
+            if guardrail is not None:
+                raise guardrail from exc
+            raise
+        guarded = self._guarded(events)
+        if stream:
+            return guarded
+        final_response = None
+        async for event in guarded:
+            if getattr(event, "type", None) == "response.completed":
+                final_response = event.response
+        if final_response is None:
+            msg = "ChatGPT backend stream ended without a completed response"
+            raise RuntimeError(msg)
+        return final_response
+
+    def _as_guardrail(self, exc: BaseException) -> codex.CodexContentGuardrailError | None:
+        if isinstance(exc, codex.CodexContentGuardrailError):
+            return exc
+        if codex.is_content_guardrail_error(exc):
+            return codex.CodexContentGuardrailError(self.model, exc)
+        return None
+
+    async def _guarded(self, events: Any) -> AsyncIterator[Any]:
+        """Convert mid-stream guardrail rejections and close the stream on exit."""
+        try:
+            async for event in events:
+                yield event
+        except Exception as exc:
+            guardrail = self._as_guardrail(exc)
+            if guardrail is not None:
+                raise guardrail from exc
+            raise
+        finally:
+            await self._aclose(events)
+
+    @staticmethod
+    async def _aclose(events: Any) -> None:
+        aclose = getattr(events, "aclose", None)
+        if callable(aclose):
+            with contextlib.suppress(Exception):
+                await aclose()
+            return
+        close = getattr(events, "close", None)
+        if callable(close):
+            with contextlib.suppress(Exception):
+                result = close()
+                if inspect.isawaitable(result):
+                    await result
+
+
+class _NonStreamingModel(Model):
+    """Serve the SDK's streamed run loop from a single non-streaming request.
+
+    Some OpenAI-compatible gateways do not support Server-Sent Events, or
+    deliver them unreliably (dropping structured tool-call deltas, or stalling
+    mid-stream so the whole turn waits out the read timeout). The SDK run loop
+    Strix uses only issues streamed requests, so such a gateway fails every
+    turn. Opt in with ``LLM_DISABLE_STREAMING=true`` to wrap the resolved model
+    so each turn makes one non-streaming ``get_response`` (``stream:false`` on
+    the wire) and the completed result is replayed as a single terminal stream
+    event. The run loop then executes tools and emits run items from that final
+    response exactly as it would for a real stream, so nothing else changes.
+    """
+
+    def __init__(self, inner: Model) -> None:
+        self._inner = inner
+
+    async def close(self) -> None:
+        await self._inner.close()
+
+    def get_retry_advice(self, request: ModelRetryAdviceRequest) -> ModelRetryAdvice | None:
+        return self._inner.get_retry_advice(request)
+
+    async def get_response(
+        self,
+        system_instructions: str | None,
+        input: str | list[TResponseInputItem],  # noqa: A002
+        model_settings: ModelSettings,
+        tools: list[Tool],
+        output_schema: AgentOutputSchemaBase | None,
+        handoffs: list[Handoff],
+        tracing: ModelTracing,
+        *,
+        previous_response_id: str | None,
+        conversation_id: str | None,
+        prompt: ResponsePromptParam | None,
+    ) -> ModelResponse:
+        return await self._inner.get_response(
+            system_instructions,
+            input,
+            model_settings,
+            tools,
+            output_schema,
+            handoffs,
+            tracing,
+            previous_response_id=previous_response_id,
+            conversation_id=conversation_id,
+            prompt=prompt,
+        )
+
+    async def stream_response(
+        self,
+        system_instructions: str | None,
+        input: str | list[TResponseInputItem],  # noqa: A002
+        model_settings: ModelSettings,
+        tools: list[Tool],
+        output_schema: AgentOutputSchemaBase | None,
+        handoffs: list[Handoff],
+        tracing: ModelTracing,
+        *,
+        previous_response_id: str | None,
+        conversation_id: str | None,
+        prompt: ResponsePromptParam | None,
+    ) -> AsyncIterator[TResponseStreamEvent]:
+        response = await self._inner.get_response(
+            system_instructions,
+            input,
+            model_settings,
+            tools,
+            output_schema,
+            handoffs,
+            tracing,
+            previous_response_id=previous_response_id,
+            conversation_id=conversation_id,
+            prompt=prompt,
+        )
+        yield _completed_stream_event(response, getattr(self._inner, "model", None))
+
+
+class _TurnGuardModel(Model):
+    """Keep one turn from corrupting the conversation or running away.
+
+    Tool-call ids: providers that number calls per turn (``exec_command:0``,
+    ...) restart the counter each turn, so the same id eventually appears twice
+    in one conversation and strict providers reject every subsequent request.
+    Ids that collide with the history are rewritten before the turn is
+    recorded, and already-corrupted histories are repaired on the way out.
+
+    Tool-call volume: a degenerate response can queue hundreds of calls that
+    the run loop then honours one by one. Only the first
+    ``LLM_MAX_TOOL_CALLS_PER_TURN`` calls of a response are kept.
+
+    Stalled streams: a turn that emits a few tokens and then goes silent is
+    not covered by the request timeout, which resets on any byte (keepalives
+    included). ``LLM_STREAM_IDLE_TIMEOUT`` bounds the gap between events so the
+    turn fails instead of hanging, and the existing retry path replays it.
+    """
+
+    def __init__(
+        self,
+        inner: Model,
+        *,
+        max_tool_calls_per_turn: int = 0,
+        stream_idle_timeout: float = 0.0,
+    ) -> None:
+        self._inner = inner
+        self._max_tool_calls_per_turn = max_tool_calls_per_turn
+        self._stream_idle_timeout = stream_idle_timeout
+
+    def _limiter(self) -> TurnToolCallLimiter:
+        return TurnToolCallLimiter(self._max_tool_calls_per_turn)
+
+    def _log_dropped(self, limiter: TurnToolCallLimiter) -> None:
+        if limiter.dropped:
+            logger.warning(
+                "dropped %d tool call(s) past the per-response limit of %d",
+                limiter.dropped,
+                self._max_tool_calls_per_turn,
+            )
+
+    async def close(self) -> None:
+        await self._inner.close()
+
+    def get_retry_advice(self, request: ModelRetryAdviceRequest) -> ModelRetryAdvice | None:
+        return self._inner.get_retry_advice(request)
+
+    async def get_response(
+        self,
+        system_instructions: str | None,
+        input: str | list[TResponseInputItem],  # noqa: A002
+        model_settings: ModelSettings,
+        tools: list[Tool],
+        output_schema: AgentOutputSchemaBase | None,
+        handoffs: list[Handoff],
+        tracing: ModelTracing,
+        *,
+        previous_response_id: str | None,
+        conversation_id: str | None,
+        prompt: ResponsePromptParam | None,
+    ) -> ModelResponse:
+        sanitized = dedupe_input(input)
+        rewriter = TurnCallIdRewriter(sanitized)
+        response = await self._inner.get_response(
+            system_instructions,
+            cast("str | list[TResponseInputItem]", sanitized),
+            model_settings,
+            tools,
+            output_schema,
+            handoffs,
+            tracing,
+            previous_response_id=previous_response_id,
+            conversation_id=conversation_id,
+            prompt=prompt,
+        )
+        limiter = self._limiter()
+        response.output = limiter.filter_items(rewriter.rewrite_items(list(response.output)))
+        self._log_dropped(limiter)
+        return response
+
+    async def stream_response(
+        self,
+        system_instructions: str | None,
+        input: str | list[TResponseInputItem],  # noqa: A002
+        model_settings: ModelSettings,
+        tools: list[Tool],
+        output_schema: AgentOutputSchemaBase | None,
+        handoffs: list[Handoff],
+        tracing: ModelTracing,
+        *,
+        previous_response_id: str | None,
+        conversation_id: str | None,
+        prompt: ResponsePromptParam | None,
+    ) -> AsyncIterator[TResponseStreamEvent]:
+        sanitized = dedupe_input(input)
+        rewriter = TurnCallIdRewriter(sanitized)
+        limiter = self._limiter()
+        stream = self._inner.stream_response(
+            system_instructions,
+            cast("str | list[TResponseInputItem]", sanitized),
+            model_settings,
+            tools,
+            output_schema,
+            handoffs,
+            tracing,
+            previous_response_id=previous_response_id,
+            conversation_id=conversation_id,
+            prompt=prompt,
+        )
+        async for event in _with_idle_timeout(stream, self._stream_idle_timeout):
+            guarded = _guard_event(event, rewriter, limiter)
+            if guarded is not None:
+                yield guarded
+        self._log_dropped(limiter)
+
+
+async def _aclose(stream: AsyncIterator[TResponseStreamEvent]) -> None:
+    if isinstance(stream, AsyncGenerator):
+        with contextlib.suppress(Exception):
+            await stream.aclose()
+
+
+async def _with_idle_timeout(
+    stream: AsyncIterator[TResponseStreamEvent], timeout: float
+) -> AsyncIterator[TResponseStreamEvent]:
+    if timeout <= 0:
+        async for event in stream:
+            yield event
+        return
+
+    iterator = stream.__aiter__()
+    while True:
+        try:
+            event = await asyncio.wait_for(iterator.__anext__(), timeout)
+        except StopAsyncIteration:
+            return
+        except TimeoutError:
+            await _aclose(stream)
+            message = f"model stream produced no event for {timeout:.0f}s"
+            logger.warning("%s; abandoning the turn", message)
+            raise TimeoutError(message) from None
+        yield event
+
+
+def _guard_event(
+    event: TResponseStreamEvent, rewriter: TurnCallIdRewriter, limiter: TurnToolCallLimiter
+) -> TResponseStreamEvent | None:
+    if isinstance(event, ResponseOutputItemAddedEvent | ResponseOutputItemDoneEvent):
+        rewritten = rewriter.rewrite_item(event.item)
+        if not limiter.allow(rewritten):
+            return None
+        if rewritten is not event.item:
+            return event.model_copy(update={"item": rewritten})
+        return event
+    if isinstance(event, ResponseCompletedEvent):
+        original = list(event.response.output)
+        output = limiter.filter_items(rewriter.rewrite_items(original))
+        if output != original:
+            return event.model_copy(
+                update={"response": event.response.model_copy(update={"output": output})}
+            )
+    return event
+
+
+def _completed_stream_event(
+    model_response: ModelResponse, model_name: object | None
+) -> TResponseStreamEvent:
+    """Wrap a non-streamed ``ModelResponse`` as the terminal event of a stream.
+
+    The run loop builds its authoritative per-turn response solely from the
+    ``response.completed`` event, so a single event carrying the full output
+    and usage is all it needs.
+    """
+    response = Response(
+        id=model_response.response_id or FAKE_RESPONSES_ID,
+        created_at=time.time(),
+        model=str(model_name) if model_name else "",
+        object="response",
+        output=list(model_response.output),
+        tool_choice="auto",
+        tools=[],
+        parallel_tool_calls=False,
+        usage=_response_usage(model_response.usage),
+    )
+    return ResponseCompletedEvent(
+        response=response,
+        sequence_number=0,
+        type="response.completed",
+    )
+
+
+def _response_usage(usage: Usage | None) -> ResponseUsage | None:
+    if usage is None:
+        return None
+    return ResponseUsage(
+        input_tokens=usage.input_tokens,
+        output_tokens=usage.output_tokens,
+        total_tokens=usage.total_tokens,
+        input_tokens_details=usage.input_tokens_details,
+        output_tokens_details=usage.output_tokens_details,
+    )


 class StrixProvider(MultiProvider):
@@ -43,6 +468,33 @@ class StrixProvider(MultiProvider):
            return self._get_fallback_provider("litellm"), f"ollama_chat/{stripped_model_name}"
        return self._get_fallback_provider("litellm"), original_model_name

+    def get_model(self, model_name: str | None) -> Model:
+        llm = load_settings().llm
+        slug = codex.subscription_model(model_name)
+        idle_timeout = float(llm.stream_idle_timeout)
+        if slug:
+            # The ChatGPT subscription backend is always streamed; it has no
+            # non-streaming mode to fall back to, so LLM_DISABLE_STREAMING
+            # does not apply here.
+            model: Model = _CodexResponsesModel(
+                slug,
+                codex.get_subscription_client(),
+                reasoning_effort=llm.reasoning_effort,
+            )
+        else:
+            model = super().get_model(model_name)
+            if llm.disable_streaming:
+                model = _NonStreamingModel(model)
+                # The wrapper emits its single event only once the whole request
+                # is done, so an idle gap is meaningless here; the request
+                # timeout bounds it instead.
+                idle_timeout = 0.0
+        return _TurnGuardModel(
+            model,
+            max_tool_calls_per_turn=llm.max_tool_calls_per_turn,
+            stream_idle_timeout=idle_timeout,
+        )
+

 DEFAULT_MODEL_RETRY = ModelRetrySettings(
    max_retries=5,
@@ -56,15 +508,58 @@ DEFAULT_MODEL_RETRY = ModelRetrySettings(
        retry_policies.provider_suggested(),
        retry_policies.network_error(),
        retry_policies.http_status((429, 500, 502, 503, 504)),
+        _retry_statusless_provider_errors,
    ),
 )

+RECOMMENDED_MODEL_NAMES = (
+    "openai/gpt-5.6-sol",
+    "openai/gpt-5.6-terra",
+    "openai/gpt-5.6-luna",
+    "openai/gpt-5.6",
+    "openai/gpt-5.5-pro",
+    "openai/gpt-5.5",
+    "openai/gpt-5.4",
+    "openai/gpt-5.3-codex",
+    "anthropic/claude-fable-5",
+    "anthropic/claude-opus-5",
+    "anthropic/claude-opus-4-8",
+    "anthropic/claude-sonnet-5",
+    "anthropic/claude-sonnet-4-6",
+    "vertex_ai/gemini-3.1-pro-preview",
+    "gemini/gemini-3.1-pro-preview",
+    "gemini/gemini-3.6-flash",
+    "deepseek/deepseek-v4-pro",
+    "deepseek/deepseek-v4-flash",
+    "dashscope/qwen3.8-max",
+    "dashscope/qwen3.7-max-2026-06-08",
+    "moonshot/kimi-k3",
+    "moonshot/kimi-k2.7-code",
+)
+
+_RECOMMENDED_MODEL_NAME_SET = frozenset(name.lower() for name in RECOMMENDED_MODEL_NAMES)
+
+FRONTIER_MODEL_FAMILIES = (
+    (("azure", "azure_ai", "bedrock_mantle", "chatgpt", "openai"), ("gpt-5",)),
+    (
+        ("anthropic", "azure_ai", "bedrock", "claude", "databricks", "snowflake", "vertex_ai"),
+        ("claude-fable-5", "claude-opus-5", "claude-opus-4", "claude-sonnet-5", "claude-sonnet-4"),
+    ),
+    (("google", "gemini", "vertex_ai"), ("gemini-3",)),
+    (("deepseek",), ("deepseek-v4", "deepseek-r1", "deepseek-reasoner")),
+    (("alibaba", "dashscope", "qwen"), ("qwen3.8", "qwen3.7", "qwen3-max")),
+    (("moonshot", "moonshotai", "kimi"), ("kimi-k3", "kimi-k2.7", "kimi-k2.6")),
+)
+

 def configure_sdk_model_defaults(settings: Settings) -> None:
    """Apply Strix config to SDK-native defaults."""
    llm = settings.llm
    set_tracing_disabled(True)
+    if codex.subscription_model(llm.model):
+        return
    _configure_litellm_compatibility()
+    _configure_openrouter_attribution(llm.model)
    if llm.api_key:
        set_default_openai_key(llm.api_key, use_for_tracing=False)
        _configure_litellm_default("api_key", llm.api_key)
@@ -75,6 +570,7 @@ def configure_sdk_model_defaults(settings: Settings) -> None:
        set_default_openai_api("chat_completions")
    else:
        set_default_openai_api("responses")
+    _configure_extra_headers(llm)


 def _mirror_api_key_to_provider_env(model_name: str | None, api_key: str) -> None:
@@ -109,6 +605,111 @@ def _configure_litellm_compatibility() -> None:
    litellm.suppress_debug_info = True

    _register_litellm_cost_callback()
+    _install_openrouter_stream_cost_capture()
+
+
+def _install_openrouter_stream_cost_capture() -> None:
+    """Preserve OpenRouter's per-stream cost, which LiteLLM drops when streaming.
+
+    OpenRouter reports the real charge in ``usage.cost`` of the final stream
+    chunk, but LiteLLM rebuilds streamed responses from token-only fields and
+    discards it (its non-streamed path stashes the cost in hidden params; the
+    streaming path does not). Every scan streams, so without this the cost is
+    lost and Strix falls back to a cost-map estimate that is missing entirely
+    for new models (e.g. kimi-k3), reporting $0. Subclass the OpenRouter
+    streaming handler to record the cost keyed by response id so the cost
+    callback can recover the exact charge for the matching rebuilt response.
+    """
+    import litellm
+    from litellm.llms.openrouter.chat.transformation import (
+        OpenRouterChatCompletionStreamingHandler,
+        OpenrouterConfig,
+    )
+
+    from strix.report.state import streamed_openrouter_costs
+
+    class _StrixOpenRouterStreamingHandler(OpenRouterChatCompletionStreamingHandler):
+        def chunk_parser(self, chunk: dict[str, Any]) -> Any:
+            stream = super().chunk_parser(chunk)
+            streamed_openrouter_costs.remember(
+                chunk.get("id") or getattr(stream, "id", None), chunk.get("usage")
+            )
+            return stream
+
+    class _StrixOpenrouterConfig(OpenrouterConfig):
+        def get_model_response_iterator(
+            self, streaming_response: Any, sync_stream: bool, json_mode: bool | None = False
+        ) -> Any:
+            return _StrixOpenRouterStreamingHandler(
+                streaming_response=streaming_response,
+                sync_stream=sync_stream,
+                json_mode=json_mode,
+            )
+
+    # LiteLLM's provider-config factory reads litellm.OpenrouterConfig at call
+    # time, so overriding the attribute is enough for the subclass to take
+    # effect. (type: ignore — mypy rejects reassigning a class attribute.)
+    litellm.OpenrouterConfig = _StrixOpenrouterConfig  # type: ignore[misc]
+
+
+_OPENROUTER_ATTRIBUTION_HEADERS = {
+    "HTTP-Referer": "https://strix.ai",
+    "X-Title": "Strix",
+    "X-OpenRouter-Categories": "cli-agent",
+}
+
+
+def _configure_openrouter_attribution(model_name: str | None) -> None:
+    import litellm
+
+    current: object = litellm.headers
+    existing: dict[str, str] = current if isinstance(current, dict) else {}
+    if not model_name or "openrouter/" not in model_name.strip().lower():
+        if any(key in existing for key in _OPENROUTER_ATTRIBUTION_HEADERS):
+            remaining = {
+                k: v for k, v in existing.items() if k not in _OPENROUTER_ATTRIBUTION_HEADERS
+            }
+            litellm.headers = remaining or None  # type: ignore[assignment]
+        return
+
+    litellm.headers = {**existing, **_OPENROUTER_ATTRIBUTION_HEADERS}  # type: ignore[assignment]
+
+
+def _configure_extra_headers(llm: LlmSettings) -> None:
+    """Send user-provided default headers on every LLM request.
+
+    Some OpenAI-compatible endpoints require extra HTTP headers (e.g. request
+    attribution or tenant routing) alongside the bearer token. Users supply
+    them via ``LLM_EXTRA_HEADERS``; they are applied to both routing paths:
+    the LiteLLM route (``litellm.headers``) and the SDK-native OpenAI route
+    (a default client carrying ``default_headers``), so they take effect
+    regardless of the ``STRIX_LLM`` prefix.
+    """
+    headers = llm.extra_headers
+    if not headers:
+        return
+    _merge_litellm_headers(headers)
+    _register_openai_client_with_headers(llm, headers)
+
+
+def _merge_litellm_headers(headers: dict[str, str]) -> None:
+    import litellm
+
+    current: object = litellm.headers
+    existing: dict[str, str] = current if isinstance(current, dict) else {}
+    litellm.headers = {**existing, **headers}  # type: ignore[assignment]
+
+
+def _register_openai_client_with_headers(llm: LlmSettings, headers: dict[str, str]) -> None:
+    from agents import set_default_openai_client
+    from openai import AsyncOpenAI
+
+    client = AsyncOpenAI(
+        api_key=llm.api_key or "not-needed",
+        base_url=llm.api_base,
+        default_headers=dict(headers),
+    )
+    set_default_openai_client(client, use_for_tracing=False)


 def _register_litellm_cost_callback() -> None:
@@ -134,6 +735,8 @@ def _configure_litellm_default(name: str, value: str) -> None:

 def uses_chat_completions_tool_schema(model_name: str, settings: Settings) -> bool:
    """Return whether the resolved SDK route can only receive JSON function tools."""
+    if codex.subscription_model(model_name):
+        return False
    model = model_name.strip().lower()
    if "/" in model and not model.startswith("openai/"):
        return True
@@ -156,6 +759,78 @@ def model_supports_reasoning(model_name: str) -> bool:
    return bool(entry and entry.get("supports_reasoning"))


+def is_recommended_or_frontier_model(model_name: str) -> bool:
+    """Return whether a model is recommended or in a frontier model family."""
+    name = _normalized_model_name(model_name)
+    if not name:
+        return False
+    if name in _RECOMMENDED_MODEL_NAME_SET:
+        return True
+    provider_name, bare_model_name = _split_model_provider(name)
+    return any(
+        _matches_frontier_family(provider_name, bare_model_name, provider_markers, prefixes)
+        for provider_markers, prefixes in FRONTIER_MODEL_FAMILIES
+    )
+
+
+def _normalized_model_name(model_name: str) -> str:
+    name = model_name.strip().lower()
+    for prefix in ("litellm/", "any-llm/"):
+        if name.startswith(prefix):
+            name = name[len(prefix) :]
+            break
+    return name
+
+
+def _split_model_provider(model_name: str) -> tuple[str | None, str]:
+    if "/" not in model_name:
+        return None, model_name
+    provider_name, bare_model_name = model_name.rsplit("/", 1)
+    return provider_name, bare_model_name
+
+
+def _matches_frontier_family(
+    provider_name: str | None,
+    model_name: str,
+    provider_markers: tuple[str, ...],
+    model_prefixes: tuple[str, ...],
+) -> bool:
+    if not _matches_model_prefix(model_name, model_prefixes):
+        return False
+    if provider_name is None:
+        return True
+    return _contains_provider_marker(
+        provider_name, provider_markers, split_compound_names=True
+    ) or _contains_provider_marker(model_name, provider_markers)
+
+
+def _matches_model_prefix(model_name: str, model_prefixes: tuple[str, ...]) -> bool:
+    return any(
+        candidate.startswith(prefix)
+        for candidate in _model_name_candidates(model_name)
+        for prefix in model_prefixes
+    )
+
+
+def _model_name_candidates(model_name: str) -> tuple[str, ...]:
+    if "." not in model_name:
+        return (model_name,)
+    suffixes = tuple(
+        model_name.split(".", index)[-1] for index in range(1, model_name.count(".") + 1)
+    )
+    return (model_name, *suffixes)
+
+
+def _contains_provider_marker(
+    value: str, provider_markers: tuple[str, ...], *, split_compound_names: bool = False
+) -> bool:
+    parts = set(value.replace(".", "/").split("/"))
+    if split_compound_names:
+        for separator in ("_", "-"):
+            parts.update(piece for part in tuple(parts) for piece in part.split(separator))
+    return any(marker in parts for marker in provider_markers)
+
+
 def is_known_openai_bare_model(model_name: str) -> bool:
    import litellm

@@ -164,3 +839,45 @@ def is_known_openai_bare_model(model_name: str) -> bool:
        return False
    entry = litellm.model_cost.get(name)
    return bool(entry and entry.get("litellm_provider") == "openai")
+
+
+def is_claude_model(model_name: str) -> bool:
+    return "claude" in (model_name or "").strip().lower()
+
+
+def is_bedrock_route(model_name: str) -> bool:
+    name = (model_name or "").strip().lower()
+    return name.startswith("bedrock/") or "anthropic." in name
+
+
+def _prompt_cache_name_candidates(model_name: str) -> list[str]:
+    # LiteLLM's model map keys the same model under several names; strip the
+    # route prefix, then leading dotted segments (region, provider).
+    name = (model_name or "").strip().lower()
+    for prefix in ("litellm/", "bedrock/"):
+        if name.startswith(prefix):
+            name = name[len(prefix) :]
+            break
+    candidates = [name]
+    rest = name
+    while "." in rest:
+        rest = rest.split(".", 1)[1]
+        candidates.append(rest)
+    return candidates
+
+
+def bedrock_route_supports_prompt_caching(model_name: str) -> bool:
+    # Bedrock rejects the cache marker for models LiteLLM's map doesn't
+    # recognise as cache-capable, so callers withhold it unless confirmed here.
+    import litellm
+
+    checker = getattr(getattr(litellm, "utils", None), "supports_prompt_caching", None)
+    for cand in _prompt_cache_name_candidates(model_name):
+        if checker is not None:
+            with contextlib.suppress(Exception):
+                if checker(cand):
+                    return True
+        entry = litellm.model_cost.get(cand)
+        if entry and entry.get("supports_prompt_caching"):
+            return True
+    return False
@@ -8,7 +8,9 @@ from pydantic import AliasChoices, Field
 from pydantic_settings import BaseSettings, SettingsConfigDict


-ReasoningEffort = Literal["none", "minimal", "low", "medium", "high", "xhigh"]
+ReasoningEffort = Literal["none", "minimal", "low", "medium", "high", "xhigh", "max"]
+
+DEFAULT_MAX_TURNS = 500

 _BASE_CONFIG = SettingsConfigDict(
    case_sensitive=False,
@@ -24,6 +26,7 @@ class LlmSettings(BaseSettings):
    api_key: str | None = Field(
        default=None,
        validation_alias=AliasChoices("LLM_API_KEY", "OPENAI_API_KEY"),
+        repr=False,
    )
    api_base: str | None = Field(
        default=None,
@@ -35,27 +38,80 @@ class LlmSettings(BaseSettings):
            "OLLAMA_API_BASE",
        ),
    )
+    extra_headers: dict[str, str] | None = Field(
+        default=None,
+        alias="LLM_EXTRA_HEADERS",
+        repr=False,
+    )
    reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT")
    force_required_tool_choice: bool = Field(
        default=False,
        alias="STRIX_FORCE_REQUIRED_TOOL_CHOICE",
    )
+    prompt_cache: bool = Field(
+        default=True,
+        alias="STRIX_PROMPT_CACHE",
+    )
+    disable_streaming: bool = Field(
+        default=False,
+        alias="LLM_DISABLE_STREAMING",
+    )
    timeout: int = Field(default=300, alias="LLM_TIMEOUT")
+    stream_idle_timeout: int = Field(default=300, ge=0, alias="LLM_STREAM_IDLE_TIMEOUT")
+    max_tool_calls_per_turn: int = Field(
+        default=32,
+        ge=0,
+        alias="LLM_MAX_TOOL_CALLS_PER_TURN",
+    )
+
+
+class DedupeSettings(BaseSettings):
+    model_config = _BASE_CONFIG
+
+    model: str | None = Field(default=None, alias="STRIX_DEDUPE_MODEL")
+    reasoning_effort: ReasoningEffort | None = Field(
+        default=None,
+        alias="STRIX_DEDUPE_REASONING_EFFORT",
+    )
+    api_key: str | None = Field(default=None, alias="DEDUPE_LLM_API_KEY", repr=False)
+    api_base: str | None = Field(default=None, alias="DEDUPE_LLM_API_BASE")
+    extra_headers: dict[str, str] | None = Field(
+        default=None,
+        alias="DEDUPE_LLM_EXTRA_HEADERS",
+        repr=False,
+    )
+
+
+class ContextSettings(BaseSettings):
+    """Context-window management: per-tool-output caps and history compaction."""
+
+    model_config = _BASE_CONFIG
+
+    auto_compact: bool = Field(default=True, alias="STRIX_CONTEXT_AUTO_COMPACT")
+    compact_buffer_tokens: int = Field(default=20_000, gt=0, alias="STRIX_CONTEXT_BUFFER_TOKENS")
+    keep_tokens: int = Field(default=8_000, gt=0, alias="STRIX_CONTEXT_KEEP_TOKENS")
+    fallback_context_tokens: int = Field(
+        default=200_000, gt=0, alias="STRIX_CONTEXT_FALLBACK_TOKENS"
+    )
+    summary_max_tokens: int = Field(default=4_096, gt=0, alias="STRIX_CONTEXT_SUMMARY_TOKENS")
+    tool_output_max_tokens: int = Field(default=8_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_TOKENS")
+    tool_output_max_lines: int = Field(default=2_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_LINES")
+    # Floor above the truncation-notice size so a preview always fits.
+    tool_output_max_bytes: int = Field(
+        default=50 * 1024, ge=1024, alias="STRIX_TOOL_OUTPUT_MAX_BYTES"
+    )


 class RuntimeSettings(BaseSettings):
    model_config = _BASE_CONFIG

    image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:1.0.0",
+        default="ghcr.io/usestrix/strix-sandbox:1.3.0",
        alias="STRIX_IMAGE",
    )
    backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")
-    # Hard cap on a local target's size before we refuse to stream it into the
-    # sandbox file-by-file (the SDK copies every file individually, which stalls
-    # on large repos). Above this, the user must bind-mount via ``--mount``.
-    # Set to 0 (or less) to disable the pre-flight check entirely.
-    max_local_copy_mb: int = Field(default=1024, alias="STRIX_MAX_LOCAL_COPY_MB")
+    # Max screenshot/image tool outputs kept live per agent context (0 = none).
+    max_context_images: int = Field(default=3, ge=0, alias="STRIX_MAX_CONTEXT_IMAGES")


 class TelemetrySettings(BaseSettings):
@@ -67,13 +123,34 @@ class TelemetrySettings(BaseSettings):
 class IntegrationSettings(BaseSettings):
    model_config = _BASE_CONFIG

-    perplexity_api_key: str | None = Field(default=None, alias="PERPLEXITY_API_KEY")
+    perplexity_api_key: str | None = Field(
+        default=None,
+        alias="PERPLEXITY_API_KEY",
+        repr=False,
+    )
+    postman_api_key: str | None = Field(
+        default=None,
+        alias="POSTMAN_API_KEY",
+        repr=False,
+    )
+
+
+class ViewerSettings(BaseSettings):
+    model_config = _BASE_CONFIG
+
+    # Base URL of the Strix relay the local viewer proxies to for email
+    # verification and encrypted report delivery. The browser never talks to
+    # the relay directly; the local server is the only caller.
+    app_url: str = Field(default="https://app.strix.ai", alias="STRIX_APP_URL")


 class Settings(BaseSettings):
    model_config = _BASE_CONFIG

    llm: LlmSettings = Field(default_factory=LlmSettings)
+    dedupe: DedupeSettings = Field(default_factory=DedupeSettings)
    runtime: RuntimeSettings = Field(default_factory=RuntimeSettings)
+    context: ContextSettings = Field(default_factory=ContextSettings)
    telemetry: TelemetrySettings = Field(default_factory=TelemetrySettings)
    integrations: IntegrationSettings = Field(default_factory=IntegrationSettings)
+    viewer: ViewerSettings = Field(default_factory=ViewerSettings)
@@ -0,0 +1,117 @@
+"""Keep tool-call ids unique within a conversation.
+
+Some providers return per-turn tool-call ids (``exec_command:0``,
+``exec_command:1``, ...) whose counter restarts on every turn. Once the same
+id appears twice in one conversation, the request payload has two assistant
+tool calls sharing an id and strict providers reject the whole turn, which
+permanently kills the agent because the malformed history is replayed on
+every retry. Rewriting duplicates to fresh unique ids keeps the history
+valid for any provider.
+"""
+
+from __future__ import annotations
+
+from collections import defaultdict, deque
+from typing import Any
+from uuid import uuid4
+
+from openai.types.responses import ResponseFunctionToolCall
+
+
+def new_call_id() -> str:
+    return f"call_{uuid4().hex}"
+
+
+def collect_call_ids(items: list[Any]) -> set[str]:
+    used: set[str] = set()
+    for item in items:
+        if isinstance(item, dict):
+            call_id = item.get("call_id")
+            if isinstance(call_id, str):
+                used.add(call_id)
+        elif isinstance(item, ResponseFunctionToolCall):
+            used.add(item.call_id)
+    return used
+
+
+def dedupe_history_call_ids(items: list[Any]) -> tuple[list[Any], bool]:
+    """Rewrite duplicate call ids in a conversation history.
+
+    Outputs are paired with their call by order, so parallel calls that share
+    an id keep answering the right call after the rewrite.
+    """
+    used: set[str] = set()
+    pending: dict[str, deque[str]] = defaultdict(deque)
+    rebuilt: list[Any] = []
+    changed = False
+
+    for item in items:
+        if not isinstance(item, dict):
+            rebuilt.append(item)
+            continue
+        call_id = item.get("call_id")
+        if not isinstance(call_id, str):
+            rebuilt.append(item)
+            continue
+
+        kind = item.get("type")
+        if kind == "function_call":
+            effective = call_id
+            if call_id in used:
+                effective = new_call_id()
+                item = {**item, "call_id": effective}  # noqa: PLW2901
+                changed = True
+            used.add(effective)
+            pending[call_id].append(effective)
+        elif kind == "function_call_output":
+            queue = pending.get(call_id)
+            if queue:
+                effective = queue.popleft()
+                if effective != call_id:
+                    item = {**item, "call_id": effective}  # noqa: PLW2901
+                    changed = True
+        rebuilt.append(item)
+
+    return rebuilt, changed
+
+
+def dedupe_input(model_input: str | list[Any]) -> str | list[Any]:
+    if isinstance(model_input, str):
+        return model_input
+    rebuilt, changed = dedupe_history_call_ids(model_input)
+    return rebuilt if changed else model_input
+
+
+class TurnCallIdRewriter:
+    """Rewrite a single turn's tool-call ids that collide with the history.
+
+    A turn's items surface several times (streamed item events, then the
+    completed response), so the same original id must always map to the same
+    replacement within the turn.
+    """
+
+    def __init__(self, model_input: str | list[Any]) -> None:
+        self._used = set() if isinstance(model_input, str) else collect_call_ids(model_input)
+        self._remap: dict[str, str] = {}
+        self._settled: set[str] = set()
+
+    def rewrite_item(self, item: Any) -> Any:
+        if not isinstance(item, ResponseFunctionToolCall):
+            return item
+        original = item.call_id
+        if original in self._settled:
+            return item
+        replacement = self._remap.get(original)
+        if replacement is None:
+            if original not in self._used:
+                self._used.add(original)
+                self._settled.add(original)
+                return item
+            replacement = new_call_id()
+            self._remap[original] = replacement
+            self._used.add(replacement)
+            self._settled.add(replacement)
+        return item.model_copy(update={"call_id": replacement})
+
+    def rewrite_items(self, items: list[Any]) -> list[Any]:
+        return [self.rewrite_item(item) for item in items]
@@ -0,0 +1,46 @@
+"""Bound how many tool calls one assistant response may queue.
+
+A degenerate generation can emit hundreds or thousands of tool calls in a
+single response — typically a poll/wait loop the model writes out ahead of
+time instead of issuing one call and yielding. The run loop honours all of
+them, so the agent stops reacting to anything for hours. Keeping only the
+first ``limit`` calls of a response bounds that blast radius; the model sees
+their results on the next turn and can reconsider.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from openai.types.responses import ResponseFunctionToolCall
+
+
+class TurnToolCallLimiter:
+    """Decide, once per call, whether a turn's tool call is within the limit."""
+
+    def __init__(self, limit: int) -> None:
+        self._limit = limit
+        self._decisions: dict[str, bool] = {}
+        self._kept = 0
+        self.dropped = 0
+
+    @property
+    def enabled(self) -> bool:
+        return self._limit > 0
+
+    def allow(self, item: Any) -> bool:
+        if not self.enabled or not isinstance(item, ResponseFunctionToolCall):
+            return True
+        decided = self._decisions.get(item.call_id)
+        if decided is not None:
+            return decided
+        allowed = self._kept < self._limit
+        if allowed:
+            self._kept += 1
+        else:
+            self.dropped += 1
+        self._decisions[item.call_id] = allowed
+        return allowed
+
+    def filter_items(self, items: list[Any]) -> list[Any]:
+        return [item for item in items if self.allow(item)]
@@ -10,15 +10,24 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Literal, cast

+from strix.core.sessions import session_write_lock
+

 if TYPE_CHECKING:
+    from collections.abc import Callable
+
    from agents.items import TResponseInputItem
    from agents.memory import Session


 logger = logging.getLogger(__name__)

-Status = Literal["running", "waiting", "completed", "stopped", "crashed", "failed"]
+Status = Literal["running", "waiting", "completed", "stopped", "crashed", "failed", "budget_paused"]
+
+# Why an agent parked. The user can message any agent, so this - not the agent's
+# position in the tree - decides whether waiting is bounded: only an agent waiting
+# on other agents is re-checked on a timer.
+WaitKind = Literal["user", "agents", "stalled"]


@dataclass(slots=True)
@@ -28,6 +37,8 @@ class AgentRuntime:
    stream: Any | None = None
    interrupt_on_message: bool = False
    wake: asyncio.Event = field(default_factory=asyncio.Event)
+    mailbox: list[dict[str, Any]] = field(default_factory=list)
+    user_wake_required: bool = False


 class AgentCoordinator:
@@ -39,11 +50,19 @@ class AgentCoordinator:
        self.names: dict[str, str] = {}
        self.metadata: dict[str, dict[str, Any]] = {}
        self.pending_counts: dict[str, int] = {}
+        self.errors: dict[str, str] = {}
+        self.recovery_counts: dict[str, int] = {}
+        self.idle_resume_counts: dict[str, int] = {}
+        self.wait_kinds: dict[str, WaitKind] = {}
        self.runtimes: dict[str, AgentRuntime] = {}
+        self._parent_notified: set[str] = set()
        self._lock = asyncio.Lock()
        self._snapshot_path: Path | None = None
        self.is_shutting_down = False
        self._budget_stopped = False
+        self._reserve_stopped = False
+        self._budget_paused = False
+        self._extend_budget: Callable[[], None] | None = None

    def set_snapshot_path(self, path: Path) -> None:
        self._snapshot_path = path
@@ -62,6 +81,71 @@ class AgentCoordinator:
            for runtime in self.runtimes.values():
                runtime.wake.set()

+    @property
+    def reserve_stopped(self) -> bool:
+        return self._reserve_stopped
+
+    @property
+    def budget_paused(self) -> bool:
+        return self._budget_paused
+
+    def set_budget_extender(self, extend: Callable[[], None]) -> None:
+        self._extend_budget = extend
+
+    async def pause_for_budget(self, agent_id: str) -> None:
+        async with self._lock:
+            self._budget_paused = True
+        await self.set_status(agent_id, "budget_paused")
+
+    async def resume_from_budget_pause(self, *, exclude: str | None = None) -> None:
+        async with self._lock:
+            if not self._budget_paused:
+                return
+            self._budget_paused = False
+            paused = [aid for aid, status in self.statuses.items() if status == "budget_paused"]
+        if self._extend_budget is not None:
+            self._extend_budget()
+        for aid in paused:
+            await self.set_status(aid, "waiting")
+            if aid != exclude:
+                await self.send(
+                    aid,
+                    {
+                        "from": "system",
+                        "type": "budget_extended",
+                        "content": (
+                            "[Budget] The user extended the scan budget \u2014 continue your "
+                            "current task."
+                        ),
+                    },
+                )
+
+    async def reset_budget_stops(
+        self,
+        *,
+        budget_stopped: bool,
+        reserve_stopped: bool,
+        budget_paused: bool = False,
+    ) -> None:
+        async with self._lock:
+            self._budget_stopped = budget_stopped
+            self._reserve_stopped = reserve_stopped
+            if not budget_paused:
+                self._budget_paused = False
+                for aid, status in self.statuses.items():
+                    if status == "budget_paused":
+                        self.statuses[aid] = "waiting"
+        await self._maybe_snapshot()
+
+    async def claim_reserve_notification(self) -> str | None:
+        async with self._lock:
+            if self._reserve_stopped:
+                return None
+            self._reserve_stopped = True
+            for runtime in self.runtimes.values():
+                runtime.wake.set()
+            return next((aid for aid, parent in self.parent_of.items() if parent is None), None)
+
    async def register(
        self,
        agent_id: str,
@@ -105,61 +189,136 @@ class AgentCoordinator:
        async with self._lock:
            if agent_id in self.statuses:
                self.statuses[agent_id] = "running"
+                self.errors.pop(agent_id, None)
+                self.wait_kinds.pop(agent_id, None)
+                self.runtimes.setdefault(agent_id, AgentRuntime()).user_wake_required = False
+                self._parent_notified.discard(agent_id)
        await self._maybe_snapshot()

-    async def park_waiting(self, agent_id: str) -> None:
+    async def park_waiting(self, agent_id: str, *, wait_kind: WaitKind) -> None:
+        """Park an agent, recording what it is waiting on so the driver can time it."""
+        async with self._lock:
+            if agent_id in self.statuses:
+                self.wait_kinds[agent_id] = wait_kind
        await self.set_status(agent_id, "waiting")

-    async def set_status(self, agent_id: str, status: Status | str) -> None:
+    async def wait_kind_of(self, agent_id: str) -> WaitKind | None:
+        async with self._lock:
+            return self.wait_kinds.get(agent_id)
+
+    async def record_recovery(self, agent_id: str) -> int:
+        """Count a turn that ended without a lifecycle tool call; return the new total.
+
+        Persisted so a resumed agent cannot earn a fresh nudge budget on every
+        auto-resume and loop forever.
+        """
+        async with self._lock:
+            count = self.recovery_counts.get(agent_id, 0) + 1
+            self.recovery_counts[agent_id] = count
+        await self._maybe_snapshot()
+        return count
+
+    async def reset_recovery(self, agent_id: str) -> None:
+        """Clear the nudge budget after real progress (new message or a lifecycle tool)."""
+        async with self._lock:
+            if self.recovery_counts.pop(agent_id, None) is None:
+                return
+        await self._maybe_snapshot()
+
+    async def record_idle_resume(self, agent_id: str) -> int:
+        """Count an auto-resume that no message triggered; return the new total.
+
+        An agent that parks again after every auto-resume would otherwise burn a
+        model turn per timeout for the rest of the scan.
+        """
+        async with self._lock:
+            count = self.idle_resume_counts.get(agent_id, 0) + 1
+            self.idle_resume_counts[agent_id] = count
+        await self._maybe_snapshot()
+        return count
+
+    async def reset_idle_resumes(self, agent_id: str) -> None:
+        async with self._lock:
+            if self.idle_resume_counts.pop(agent_id, None) is None:
+                return
+        await self._maybe_snapshot()
+
+    async def set_status(
+        self, agent_id: str, status: Status | str, *, error: str | None = None
+    ) -> None:
        async with self._lock:
            if agent_id not in self.statuses:
                return
            self.statuses[agent_id] = status  # type: ignore[assignment]
+            if error is not None:
+                self.errors[agent_id] = error
+            elif status == "running":
+                self.errors.pop(agent_id, None)
+            if status == "running":
+                # Running again means a fresh stint that owes its parent its own notice.
+                self._parent_notified.discard(agent_id)
            runtime = self.runtimes.setdefault(agent_id, AgentRuntime())
+            runtime.user_wake_required = status in {"failed", "crashed"}
            runtime.wake.set()
        logger.info("agent.status %s=%s", agent_id, status)
        await self._maybe_snapshot()

-    async def send(self, target_agent_id: str, message: dict[str, Any]) -> bool:
-        """Deliver a user/peer message by appending it to the target SDK session."""
+    async def claim_parent_notice(self, agent_id: str) -> bool:
+        """Reserve the one notice a child owes its parent when it stops running.
+
+        A completion report and a terminal notice carry the same information, so
+        whichever comes first claims the slot and the other is skipped.
+        """
+        async with self._lock:
+            if agent_id in self._parent_notified:
+                return False
+            self._parent_notified.add(agent_id)
+            return True
+
+    async def send(
+        self, target_agent_id: str, message: dict[str, Any], *, interrupt: bool = True
+    ) -> bool:
+        """Queue a user/peer message in the target's mailbox and wake it."""
+        from_user = message.get("from") == "user"
+        if from_user and self._budget_paused:
+            await self.resume_from_budget_pause(exclude=target_agent_id)
        async with self._lock:
            if target_agent_id not in self.statuses:
                logger.debug("agent.send dropped unknown target=%s", target_agent_id)
                return False
            runtime = self.runtimes.setdefault(target_agent_id, AgentRuntime())
-            session = runtime.session
-            stream = runtime.stream
-            interrupt = runtime.interrupt_on_message
-        if session is None:
-            logger.warning(
-                "agent.send dropped target=%s because its SDK session is not attached",
-                target_agent_id,
-            )
-            return False
-        try:
-            await session.add_items([self._message_to_session_item(message)])
-        except Exception:
-            logger.exception(
-                "agent.send failed to append to SDK session target=%s",
-                target_agent_id,
-            )
-            return False
-        async with self._lock:
+            runtime.mailbox.append(dict(message))
            self.pending_counts[target_agent_id] = self.pending_counts.get(target_agent_id, 0) + 1
-            self.runtimes.setdefault(target_agent_id, AgentRuntime()).wake.set()
-        if stream is not None and interrupt:
+            if from_user:
+                runtime.user_wake_required = False
+            runtime.wake.set()
+            stream = runtime.stream
+            interrupt_on_message = runtime.interrupt_on_message
+        if stream is not None and interrupt and interrupt_on_message:
            stream.cancel(mode="immediate")
        await self._maybe_snapshot()
        return True

-    async def wait_for_message(self, agent_id: str) -> None:
+    async def wait_for_message(self, agent_id: str, *, timeout: float | None = None) -> bool:
+        """Wait until a message is ready for ``agent_id``; False on ``timeout``."""
        while True:
            async with self._lock:
-                if self._budget_stopped or self.pending_counts.get(agent_id, 0) > 0:
-                    return
-                wake = self.runtimes.setdefault(agent_id, AgentRuntime()).wake
+                runtime = self.runtimes.setdefault(agent_id, AgentRuntime())
+                reserve_exit = self._reserve_stopped and self.parent_of.get(agent_id) is not None
+                pending_ready = (
+                    self.pending_counts.get(agent_id, 0) > 0 and not runtime.user_wake_required
+                )
+                if self._budget_stopped or reserve_exit or pending_ready:
+                    return True
+                wake = runtime.wake
                wake.clear()
-            await wake.wait()
+            if timeout is None:
+                await wake.wait()
+            else:
+                try:
+                    await asyncio.wait_for(wake.wait(), timeout)
+                except TimeoutError:
+                    return False

    async def consume_pending(
        self,
@@ -167,17 +326,38 @@ class AgentCoordinator:
        *,
        include_items: bool = False,
    ) -> tuple[int, list[Any]]:
+        """Drain the agent's mailbox into its own SDK session."""
        async with self._lock:
-            count = self.pending_counts.get(agent_id, 0)
+            runtime = self.runtimes.setdefault(agent_id, AgentRuntime())
+            queued = list(runtime.mailbox)
+            runtime.mailbox.clear()
+            count = max(self.pending_counts.get(agent_id, 0), len(queued))
            self.pending_counts[agent_id] = 0
-            session = self.runtimes.get(agent_id, AgentRuntime()).session
+            session = runtime.session
        if count <= 0:
            return 0, []
+        items = [self._message_to_session_item(m) for m in queued]
+        if items:
+            if session is None:
+                logger.warning(
+                    "agent %s has no SDK session attached; %d queued messages were not persisted",
+                    agent_id,
+                    len(items),
+                )
+            else:
+                try:
+                    async with session_write_lock(session):
+                        await session.add_items(items)
+                except Exception:
+                    logger.exception(
+                        "failed to append %d queued messages to the session of %s",
+                        len(items),
+                        agent_id,
+                    )
        await self._maybe_snapshot()
-        if not include_items or session is None:
+        if not include_items:
            return count, []
-        items = await session.get_items()
-        return count, list(items[-count:])
+        return count, items

    async def request_stop(self, agent_id: str) -> None:
        async with self._lock:
@@ -203,12 +383,15 @@ class AgentCoordinator:
        if tasks:
            await asyncio.gather(*tasks, return_exceptions=True)

-    async def cancel_descendants_graceful(self, agent_id: str) -> None:
+    async def cancel_descendants_graceful(self, agent_id: str) -> list[str]:
+        """Stop a subtree leaves-first and report which agents were stopped."""
        async with self._lock:
            order = self._subtree_order_locked(agent_id)
-        for aid in reversed(order):
+        stopped = list(reversed(order))
+        for aid in stopped:
            await self.request_stop(aid)
        await self._maybe_snapshot()
+        return stopped

    async def attach_stream(
        self,
@@ -243,9 +426,14 @@ class AgentCoordinator:

    async def graph_snapshot(
        self,
-    ) -> tuple[dict[str, str | None], dict[str, Status], dict[str, str]]:
+    ) -> tuple[dict[str, str | None], dict[str, Status], dict[str, str], dict[str, str]]:
        async with self._lock:
-            return dict(self.parent_of), dict(self.statuses), dict(self.names)
+            return (
+                dict(self.parent_of),
+                dict(self.statuses),
+                dict(self.names),
+                dict(self.errors),
+            )

    def _message_to_session_item(self, message: dict[str, Any]) -> TResponseInputItem:
        sender = str(message.get("from", "unknown"))
@@ -283,6 +471,18 @@ class AgentCoordinator:
                "names": dict(self.names),
                "metadata": {aid: dict(md) for aid, md in self.metadata.items()},
                "pending_counts": dict(self.pending_counts),
+                "recovery_counts": dict(self.recovery_counts),
+                "idle_resume_counts": dict(self.idle_resume_counts),
+                "wait_kinds": dict(self.wait_kinds),
+                "mailboxes": {
+                    aid: [dict(m) for m in runtime.mailbox]
+                    for aid, runtime in self.runtimes.items()
+                    if runtime.mailbox
+                },
+                "errors": dict(self.errors),
+                "budget_stopped": self._budget_stopped,
+                "reserve_stopped": self._reserve_stopped,
+                "budget_paused": self._budget_paused,
            }

    async def restore(self, snap: dict[str, Any]) -> None:
@@ -292,6 +492,19 @@ class AgentCoordinator:
            self.names = dict(snap.get("names", {}))
            self.metadata = {aid: dict(md) for aid, md in snap.get("metadata", {}).items()}
            self.pending_counts = dict(snap.get("pending_counts", {}))
+            self.errors = dict(snap.get("errors", {}))
+            self.recovery_counts = dict(snap.get("recovery_counts", {}))
+            self.idle_resume_counts = dict(snap.get("idle_resume_counts", {}))
+            self.wait_kinds = dict(snap.get("wait_kinds", {}))
+            mailboxes = snap.get("mailboxes", {})
+            if isinstance(mailboxes, dict):
+                for aid, msgs in mailboxes.items():
+                    if isinstance(msgs, list):
+                        runtime = self.runtimes.setdefault(aid, AgentRuntime())
+                        runtime.mailbox = [dict(m) for m in msgs if isinstance(m, dict)]
+            self._budget_stopped = bool(snap.get("budget_stopped", False))
+            self._reserve_stopped = bool(snap.get("reserve_stopped", False))
+            self._budget_paused = bool(snap.get("budget_paused", False))
            for aid in self.statuses:
                self.runtimes.setdefault(aid, AgentRuntime())

@@ -9,15 +9,32 @@ import uuid
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any, cast

+import litellm
 from agents import RunConfig, Runner
 from agents.exceptions import AgentsException, MaxTurnsExceeded, UserError
 from agents.sandbox.errors import ExecTransportError
 from docker import errors as docker_errors  # type: ignore[import-untyped, unused-ignore]
-from openai import APIError
+from openai import (
+    APIConnectionError,
+    APIError,
+    APITimeoutError,
+)

-from strix.core.hooks import BudgetExceededError
+from strix.config import codex
+from strix.core.hooks import (
+    BudgetExceededError,
+    BudgetPausedError,
+    SubagentBudgetReservedError,
+)
 from strix.core.inputs import child_initial_input
-from strix.core.sessions import open_agent_session, strip_all_images_from_session
+from strix.core.sessions import (
+    enforce_image_budget,
+    open_agent_session,
+    replace_session_items,
+    seed_initial_input,
+    strip_all_images_from_session,
+)
+from strix.llm.compaction import is_context_overflow, maybe_compact


 if TYPE_CHECKING:
@@ -36,6 +53,120 @@ logger = logging.getLogger(__name__)
 StreamEventSink = Callable[[str, Any], None]

 _INPUT_REJECTION_CODES = frozenset({400, 404, 422})
+_MAX_COMPACTIONS_PER_CYCLE = 2
+
+
+class ProviderRefusalError(AgentsException):
+    """Raised when a provider returns a structured refusal instead of an exception."""
+
+
+def _structured_provider_refusal(result: Any) -> str | None:
+    for item in getattr(result, "new_items", ()) or ():
+        raw_item = getattr(item, "raw_item", None)
+        for content in getattr(raw_item, "content", ()) or ():
+            if getattr(content, "type", None) != "refusal":
+                continue
+            refusal = getattr(content, "refusal", None)
+            if isinstance(refusal, str) and refusal.strip():
+                return refusal.strip()
+            return "The model provider refused this request."
+    return None
+
+
+def _run_config_model(run_config: RunConfig) -> str | None:
+    return run_config.model if isinstance(run_config.model, str) else None
+
+
+def _agent_instructions(agent: Any) -> str:
+    instructions = getattr(agent, "instructions", None)
+    return instructions if isinstance(instructions, str) else ""
+
+
+def _agent_tools_text(agent: Any) -> str:
+    parts: list[str] = []
+    for tool in getattr(agent, "tools", []) or []:
+        name = getattr(tool, "name", "")
+        description = getattr(tool, "description", "") or ""
+        schema = getattr(tool, "params_json_schema", "") or ""
+        parts.append(f"{name} {description} {schema}")
+    return "\n".join(parts)
+
+
+async def _compact_session(
+    agent: Any, session: Session, run_config: RunConfig, *, force: bool
+) -> bool:
+    model = _run_config_model(run_config)
+    if session is None or model is None:
+        return False
+    return await maybe_compact(
+        session,
+        model=model,
+        instructions=_agent_instructions(agent),
+        tools_text=_agent_tools_text(agent),
+        force=force,
+    )
+
+
+_MAX_TRANSIENT_MODEL_RETRIES = 5
+_TRANSIENT_MODEL_RETRY_BASE_DELAY_S = 2.0
+_TRANSIENT_MODEL_RETRY_MAX_DELAY_S = 90.0
+
+
+def _model_error_status_code(exc: BaseException) -> int | None:
+    code = getattr(exc, "status_code", None)
+    return code if isinstance(code, int) else None
+
+
+def _is_transient_model_error(exc: BaseException) -> bool:
+    if codex.is_content_guardrail_error(exc):
+        return False
+    if isinstance(
+        exc, APITimeoutError | APIConnectionError | TimeoutError | ConnectionError | OSError
+    ):
+        return True
+    code = _model_error_status_code(exc)
+    if code is not None:
+        return bool(litellm._should_retry(code))
+    return isinstance(exc, APIError)
+
+
+def _transient_model_retry_delay(attempt: int) -> float:
+    delay = _TRANSIENT_MODEL_RETRY_BASE_DELAY_S * float(2 ** (attempt - 1))
+    return min(delay, _TRANSIENT_MODEL_RETRY_MAX_DELAY_S)
+
+
+async def _salvage_stream_to_session(
+    session: Session,
+    pre_run_items: list[Any],
+    stream: Any,
+    agent_id: str,
+) -> None:
+    """Persist a crashed run's full history so a revived agent loses no context."""
+    if stream is None:
+        return
+    try:
+        replay = list(stream.to_input_list())
+    except Exception:
+        logger.exception("could not build salvage history for %s", agent_id)
+        return
+    desired = list(pre_run_items) + replay
+    if len(desired) <= len(pre_run_items):
+        return
+    try:
+        await replace_session_items(session, desired)
+    except Exception:
+        logger.exception("salvaging crashed run history failed for %s", agent_id)
+
+
+async def _seed_and_prepare_first_input(
+    session: Session | None, initial_input: Any, *, start_parked: bool
+) -> Any:
+    """Persist the opening input up front so it survives a first-turn crash."""
+    if initial_input and session is not None and not start_parked:
+        with contextlib.suppress(Exception):
+            if await seed_initial_input(session, initial_input):
+                return []
+    return initial_input


 async def run_agent_loop(
@@ -60,13 +191,29 @@ async def run_agent_loop(
    )
    result: RunResultBase | None = None

+    first_cycle_input = await _seed_and_prepare_first_input(
+        session, initial_input, start_parked=start_parked
+    )
+
+    budget_stopped = coordinator.budget_stopped
+    reserve_stopped = coordinator.reserve_stopped
+    if budget_stopped:
+        await coordinator.set_status(agent_id, "stopped")
+        raise BudgetExceededError("scan budget reached")
+    if reserve_stopped and context.get("parent_id") is not None:
+        await coordinator.set_status(agent_id, "stopped")
+        raise SubagentBudgetReservedError("scan reached the sub-agent budget reserve")
+
+    if reserve_stopped and start_parked and interactive and context.get("parent_id") is None:
+        await coordinator.send(agent_id, _reserve_notice())
+
    if not (start_parked and interactive):
-        if interactive:
-            result = await _run_cycle(
+        with contextlib.suppress(BudgetPausedError):
+            result = await _run_until_lifecycle(
                agent,
                coordinator,
                agent_id,
-                input_data=initial_input,
+                initial_input=first_cycle_input,
                run_config=run_config,
                context=context,
                max_turns=max_turns,
@@ -75,26 +222,14 @@ async def run_agent_loop(
                event_sink=event_sink,
                hooks=hooks,
            )
-        else:
-            result = await _run_noninteractive_until_lifecycle(
-                agent,
-                coordinator,
-                agent_id,
-                initial_input=initial_input,
-                run_config=run_config,
-                context=context,
-                max_turns=max_turns,
-                session=session,
-                event_sink=event_sink,
-                hooks=hooks,
-            )

    if not interactive:
        return result

    while True:
+        timeout = await _plain_waiting_timeout(coordinator, agent_id)
        try:
-            await coordinator.wait_for_message(agent_id)
+            woke = await coordinator.wait_for_message(agent_id, timeout=timeout)
        except asyncio.CancelledError:
            return result

@@ -102,20 +237,53 @@ async def run_agent_loop(
            await coordinator.set_status(agent_id, "stopped")
            raise BudgetExceededError("scan budget reached")

+        if coordinator.reserve_stopped and context.get("parent_id") is not None:
+            await coordinator.set_status(agent_id, "stopped")
+            raise SubagentBudgetReservedError("scan reached the sub-agent budget reserve")
+
+        if woke:
+            # Real input is real progress, so the nudge budget starts over. A bare
+            # auto-resume is not: it must not hand a wedged agent a fresh budget.
+            await coordinator.reset_recovery(agent_id)
+            await coordinator.reset_idle_resumes(agent_id)
+        else:
+            idle_resumes = await coordinator.record_idle_resume(agent_id)
+            if idle_resumes >= _MAX_IDLE_AUTO_RESUMES:
+                logger.warning(
+                    "agent %s auto-resumed %d times without hearing from anyone; "
+                    "leaving it parked until a real message arrives",
+                    agent_id,
+                    idle_resumes,
+                )
+                await coordinator.park_waiting(agent_id, wait_kind="stalled")
+                await _notify_parent_on_stall(coordinator, agent_id)
+                continue
+            logger.info("agent %s reached its waiting timeout; auto-resuming", agent_id)
+            await coordinator.send(
+                agent_id,
+                {
+                    "from": "system",
+                    "type": "auto_resume",
+                    "content": "Waiting timeout reached. Resuming execution.",
+                },
+                interrupt=False,
+            )
+
        await coordinator.consume_pending(agent_id)
-        result = await _run_cycle(
-            agent,
-            coordinator,
-            agent_id,
-            input_data=[],
-            run_config=run_config,
-            context=context,
-            max_turns=max_turns,
-            session=session,
-            interactive=interactive,
-            event_sink=event_sink,
-            hooks=hooks,
-        )
+        with contextlib.suppress(BudgetPausedError):
+            result = await _run_until_lifecycle(
+                agent,
+                coordinator,
+                agent_id,
+                initial_input=[],
+                run_config=run_config,
+                context=context,
+                max_turns=max_turns,
+                session=session,
+                interactive=True,
+                event_sink=event_sink,
+                hooks=hooks,
+            )


 async def spawn_child_agent(
@@ -263,7 +431,10 @@ async def respawn_subagents(
                await coordinator.set_status(child_id, "crashed")


-async def _run_noninteractive_until_lifecycle(
+_INTERACTIVE_TOOL_RECOVERY_LIMIT = 3
+
+
+async def _run_until_lifecycle(
    agent: Any,
    coordinator: AgentCoordinator,
    agent_id: str,
@@ -273,21 +444,167 @@ async def _run_noninteractive_until_lifecycle(
    context: dict[str, Any],
    max_turns: int,
    session: Session | None,
+    interactive: bool,
    event_sink: StreamEventSink | None,
    hooks: RunHooks[dict[str, Any]] | None,
 ) -> RunResultBase | None:
-    """Non-chat mode keeps running until finish_scan / agent_finish settles status."""
+    """Drive an agent until an explicit lifecycle tool settles its status.
+
+    A turn that ends without ``finish_scan``, ``agent_finish``,
+    ``respond_to_user``, or ``wait_for_agents`` leaves the agent ``running``:
+    plain text never terminates a run and never yields to the user. Such a turn
+    is nudged back into a tool call, bounded by a recovery limit.
+    """
    result: RunResultBase | None = None
    input_data: Any = initial_input
-    invalid_final_outputs = 0
-    invalid_final_output_limit = max(1, max_turns)
+    recovery_limit = _INTERACTIVE_TOOL_RECOVERY_LIMIT if interactive else max(1, max_turns)

    while True:
        if coordinator.budget_stopped:
            await coordinator.set_status(agent_id, "stopped")
            raise BudgetExceededError("scan budget reached")

-        result = await _run_cycle(
+        if coordinator.reserve_stopped and context.get("parent_id") is not None:
+            await coordinator.set_status(agent_id, "stopped")
+            raise SubagentBudgetReservedError("scan reached the sub-agent budget reserve")
+
+        if interactive:
+            result = await _run_cycle_parked(
+                agent,
+                coordinator,
+                agent_id,
+                input_data=input_data,
+                run_config=run_config,
+                context=context,
+                max_turns=max_turns,
+                session=session,
+                event_sink=event_sink,
+                hooks=hooks,
+            )
+        else:
+            result = await _run_cycle(
+                agent,
+                coordinator,
+                agent_id,
+                input_data=input_data,
+                run_config=run_config,
+                context=context,
+                max_turns=max_turns,
+                session=session,
+                interactive=False,
+                event_sink=event_sink,
+                hooks=hooks,
+            )
+
+        status = await _agent_status(coordinator, agent_id)
+        if status != "running":
+            await coordinator.reset_recovery(agent_id)
+            return result
+
+        recoveries = await coordinator.record_recovery(agent_id)
+        logger.warning(
+            "agent %s ended a turn without a lifecycle tool call (interactive=%s); "
+            "forcing tool continuation (%d/%d): %s",
+            agent_id,
+            interactive,
+            recoveries,
+            recovery_limit,
+            _final_output_preview(result),
+        )
+
+        if recoveries >= recovery_limit:
+            return await _exhausted_recovery(coordinator, agent_id, result, interactive=interactive)
+
+        input_data = await _append_tool_required_message(
+            session=session,
+            context=context,
+            attempt=recoveries,
+            limit=recovery_limit,
+            interactive=interactive,
+        )
+
+
+async def _exhausted_recovery(
+    coordinator: AgentCoordinator,
+    agent_id: str,
+    result: RunResultBase | None,
+    *,
+    interactive: bool,
+) -> RunResultBase | None:
+    """Settle an agent that never recovered into a tool call.
+
+    Interactive runs park instead of dying: a human is attached and can message
+    any agent, so the scan stays resumable. Autonomous runs have nobody to
+    resume them, so they fail loudly.
+    """
+    if not interactive:
+        await coordinator.set_status(agent_id, "crashed")
+        await notify_parent_on_terminal(coordinator, agent_id, "crashed")
+        raise MaxTurnsExceeded(
+            "Agent exhausted recovery attempts without calling finish_scan or agent_finish."
+        )
+
+    logger.warning(
+        "agent %s exhausted tool-call recovery attempts; parking until a message arrives",
+        agent_id,
+    )
+    await coordinator.park_waiting(agent_id, wait_kind="stalled")
+    # A parked child owes its parent a completion report it can no longer send. The
+    # parent is an agent, not a watching human, so nothing else tells it to stop
+    # waiting and it burns its full timeout on a message that is never coming.
+    await _notify_parent_on_stall(coordinator, agent_id)
+    return result
+
+
+_WAITING_AUTO_RESUME_TIMEOUT_S = 300.0
+
+# An agent that parks again after every auto-resume makes no progress, so stop
+# spending a model turn per timeout and leave it parked for a real message.
+_MAX_IDLE_AUTO_RESUMES = 3
+
+
+async def _plain_waiting_timeout(
+    coordinator: AgentCoordinator,
+    agent_id: str,
+) -> float | None:
+    """Auto-resume timeout for a parked agent; None waits until a message arrives.
+
+    Driven by what the agent is waiting on, not by where it sits in the graph:
+    the user can message any agent, so an agent awaiting a human parks
+    indefinitely whether or not it is the root. Only an agent awaiting other
+    agents is re-checked on a timer, and only until it has spent its idle
+    budget re-parking without hearing anything.
+    """
+    async with coordinator._lock:
+        status = coordinator.statuses.get(agent_id)
+        has_error = agent_id in coordinator.errors
+        runtime = coordinator.runtimes.get(agent_id)
+        gated = runtime.user_wake_required if runtime is not None else False
+        wait_kind = coordinator.wait_kinds.get(agent_id)
+        idle_resumes = coordinator.idle_resume_counts.get(agent_id, 0)
+    if status != "waiting" or has_error or gated:
+        return None
+    if wait_kind != "agents" or idle_resumes >= _MAX_IDLE_AUTO_RESUMES:
+        return None
+    return _WAITING_AUTO_RESUME_TIMEOUT_S
+
+
+async def _run_cycle_parked(
+    agent: Any,
+    coordinator: AgentCoordinator,
+    agent_id: str,
+    *,
+    input_data: Any,
+    run_config: RunConfig,
+    context: dict[str, Any],
+    max_turns: int,
+    session: Session | None,
+    event_sink: StreamEventSink | None,
+    hooks: RunHooks[dict[str, Any]] | None,
+) -> RunResultBase | None:
+    """Interactive run cycle that parks on any error instead of killing the runner."""
+    try:
+        return await _run_cycle(
            agent,
            coordinator,
            agent_id,
@@ -296,39 +613,17 @@ async def _run_noninteractive_until_lifecycle(
            context=context,
            max_turns=max_turns,
            session=session,
-            interactive=False,
+            interactive=True,
            event_sink=event_sink,
            hooks=hooks,
        )
-
-        status = await _agent_status(coordinator, agent_id)
-        if status != "running":
-            return result
-
-        invalid_final_outputs += 1
-        logger.warning(
-            "agent %s produced non-lifecycle final output in non-interactive mode; "
-            "forcing tool continuation (%d/%d): %s",
-            agent_id,
-            invalid_final_outputs,
-            invalid_final_output_limit,
-            _final_output_preview(result),
-        )
-
-        if invalid_final_outputs >= invalid_final_output_limit:
-            await coordinator.set_status(agent_id, "crashed")
-            await _notify_parent_on_crash(coordinator, agent_id, "crashed")
-            raise MaxTurnsExceeded(
-                "Agent exhausted non-interactive recovery attempts without calling "
-                "finish_scan or agent_finish."
-            )
-
-        input_data = await _append_noninteractive_tool_required_message(
-            session=session,
-            context=context,
-            attempt=invalid_final_outputs,
-            limit=invalid_final_output_limit,
-        )
+    except (BudgetExceededError, BudgetPausedError, SubagentBudgetReservedError):
+        raise
+    except Exception as exc:
+        logger.exception("error escaped the run cycle for %s; parking as failed", agent_id)
+        await coordinator.set_status(agent_id, "failed", error=str(exc) or type(exc).__name__)
+        await notify_parent_on_terminal(coordinator, agent_id, "failed")
+        return None


 async def _run_cycle(  # noqa: PLR0912, PLR0915
@@ -346,9 +641,26 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
    hooks: RunHooks[dict[str, Any]] | None,
 ) -> RunResultBase | None:
    image_strips = 0
+    compactions = 0
+    model_retries = 0
    while True:
+        stream: Any = None
+        pre_run_items: list[Any] = []
        try:
            await coordinator.mark_running(agent_id)
+            if session is not None:
+                max_images = context.get("max_context_images")
+                if isinstance(max_images, int):
+                    try:
+                        await enforce_image_budget(session, max_images)
+                    except Exception:
+                        logger.exception("image-budget enforcement failed for %s", agent_id)
+                try:
+                    await _compact_session(agent, session, run_config, force=False)
+                except Exception:
+                    logger.exception("proactive compaction failed for %s", agent_id)
+                with contextlib.suppress(Exception):
+                    pre_run_items = list(await session.get_items())
            stream = Runner.run_streamed(
                agent,
                input=input_data,
@@ -369,9 +681,9 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
                                logger.exception("stream event sink failed for %s", agent_id)
                    if stream.run_loop_exception is not None:
                        raise stream.run_loop_exception
-                except BudgetExceededError:
-                    # A RuntimeError subclass: re-raise explicitly so it is never
-                    # mistaken for the LiteLLM "after shutdown" race below.
+                    if refusal := _structured_provider_refusal(stream):
+                        raise ProviderRefusalError(refusal)
+                except (BudgetExceededError, BudgetPausedError, SubagentBudgetReservedError):
                    raise
                except RuntimeError as stream_exc:
                    if "after shutdown" not in str(stream_exc):
@@ -390,6 +702,15 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
                    )
            finally:
                await coordinator.detach_stream(agent_id, stream)
+        except BudgetPausedError as exc:
+            logger.info("agent %s paused at the scan budget limit: %s", agent_id, exc)
+            await coordinator.pause_for_budget(agent_id)
+            raise
+        except SubagentBudgetReservedError as exc:
+            logger.info("sub-agent %s stopped at the budget reserve: %s", agent_id, exc)
+            await coordinator.set_status(agent_id, "stopped")
+            await _notify_root_on_budget_reserve(coordinator)
+            raise
        except BudgetExceededError as exc:
            logger.info(
                "agent %s reached the scan budget limit; stopping the scan: %s", agent_id, exc
@@ -417,40 +738,66 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
                    )
                    input_data = []
                    continue
-            if not interactive:
-                raise
+            if (
+                compactions < _MAX_COMPACTIONS_PER_CYCLE
+                and session is not None
+                and is_context_overflow(exc)
+            ):
+                try:
+                    compacted = await _compact_session(agent, session, run_config, force=True)
+                except Exception:
+                    logger.exception("overflow compaction recovery failed for %s", agent_id)
+                    compacted = False
+                if compacted:
+                    compactions += 1
+                    logger.info(
+                        "Compacted %s session after context overflow; retrying (%d)",
+                        agent_id,
+                        compactions,
+                    )
+                    input_data = []
+                    continue
+            if model_retries < _MAX_TRANSIENT_MODEL_RETRIES and _is_transient_model_error(exc):
+                model_retries += 1
+                delay = _transient_model_retry_delay(model_retries)
+                logger.warning(
+                    "transient model/provider error for %s; replaying turn "
+                    "(attempt %d/%d, backoff %.1fs): %r",
+                    agent_id,
+                    model_retries,
+                    _MAX_TRANSIENT_MODEL_RETRIES,
+                    delay,
+                    exc,
+                )
+                await asyncio.sleep(delay)
+                if session is not None:
+                    input_data = []
+                continue
+            if session is not None:
+                await _salvage_stream_to_session(session, pre_run_items, stream, agent_id)
+            if isinstance(exc, ProviderRefusalError):
+                logger.warning("agent %s refused by the model provider: %s", agent_id, exc)
+                await coordinator.set_status(agent_id, "failed", error=str(exc))
+                await notify_parent_on_terminal(coordinator, agent_id, "failed")
+                return None
            if isinstance(exc, MaxTurnsExceeded):
                status: Status = "stopped"
            elif isinstance(exc, UserError | AgentsException | APIError):
                status = "failed"
            else:
                status = "crashed"
-            logger.exception("agent run failed for %s; parking as %s", agent_id, status)
-            await coordinator.set_status(agent_id, status)
-            await _notify_parent_on_crash(coordinator, agent_id, status)
-            if context.get("parent_id") is None and status in {"failed", "crashed"}:
+            logger.exception("agent run failed for %s; marking %s", agent_id, status)
+            # Settle the status and wake the parent before the exception unwinds a
+            # non-interactive agent's task: a child that dies still owes its parent a
+            # report, and the parent would otherwise wait out its timeout on a message
+            # the dead child can no longer send.
+            await coordinator.set_status(agent_id, status, error=str(exc) or type(exc).__name__)
+            await notify_parent_on_terminal(coordinator, agent_id, status)
+            if not interactive:
                raise
            return None
        else:
-            await _settle_run_result(coordinator, agent_id, interactive)
-            return stream
-
-
-async def _settle_run_result(
-    coordinator: AgentCoordinator,
-    agent_id: str,
-    interactive: bool,
-) -> None:
-    async with coordinator._lock:
-        current_status = coordinator.statuses.get(agent_id)
-
-    if current_status != "running":
-        return
-
-    if not interactive:
-        return
-
-    await coordinator.set_status(agent_id, "waiting")
+            return cast("RunResultBase | None", stream)


 async def _agent_status(coordinator: AgentCoordinator, agent_id: str) -> Status | None:
@@ -468,23 +815,37 @@ def _final_output_preview(result: RunResultBase | None) -> str:
    return text[:300]


-async def _append_noninteractive_tool_required_message(
+async def _append_tool_required_message(
    *,
    session: Session | None,
    context: dict[str, Any],
    attempt: int,
    limit: int,
+    interactive: bool,
 ) -> list[dict[str, str]]:
    finish_tool = "finish_scan" if context.get("parent_id") is None else "agent_finish"
-    message = (
-        "Your previous response ended the autonomous Strix run without a lifecycle tool call. "
-        "That is invalid in non-interactive mode; plain text final answers are ignored. "
-        "Continue immediately and call exactly one tool. "
-        f"If your work is complete, call {finish_tool}. "
-        "If you are blocked waiting for another agent, call wait_for_message. "
-        "Otherwise use the appropriate execution or planning tool. "
-        f"This is recovery attempt {attempt}/{limit}."
-    )
+    if interactive:
+        message = (
+            "Your previous message ended a turn without a tool call. Plain text never ends "
+            "execution and never hands control to the user: it is shown to the user, and the "
+            "run continues. Continue immediately and call exactly one tool. "
+            "If you have something to tell the user and nothing to do until they reply, "
+            "call respond_to_user. "
+            "If you are blocked waiting for another agent, call wait_for_agents. "
+            f"If the whole engagement is complete, call {finish_tool}. "
+            "Otherwise use the appropriate execution or planning tool. "
+            f"This is recovery attempt {attempt}/{limit}."
+        )
+    else:
+        message = (
+            "Your previous response ended the autonomous run without a lifecycle tool "
+            "call. That is invalid in non-interactive mode; plain text final answers are "
+            "ignored. Continue immediately and call exactly one tool. "
+            f"If your work is complete, call {finish_tool}. "
+            "If you are blocked waiting for another agent, call wait_for_agents. "
+            "Otherwise use the appropriate execution or planning tool. "
+            f"This is recovery attempt {attempt}/{limit}."
+        )
    item = {"role": "user", "content": message}
    if session is None:
        return [item]
@@ -493,13 +854,42 @@ async def _append_noninteractive_tool_required_message(
    return []


-async def _notify_parent_on_crash(
+_TERMINAL_NOTICE = {
+    "completed": (
+        "[Agent completed] {name} ({agent_id}) finished and is no longer running, but it "
+        "sent no completion report. Stop waiting on this child; ask it directly if you "
+        "need its results."
+    ),
+    "crashed": (
+        "[Agent crash] {name} ({agent_id}) terminated unexpectedly. "
+        "Stop waiting on this child unless you want to message it again."
+    ),
+    "failed": (
+        "[Agent failed] {name} ({agent_id}) stopped with an error and will not "
+        "send a completion report. Stop waiting on this child unless you want to "
+        "message it again."
+    ),
+    "stopped": (
+        "[Agent stopped] {name} ({agent_id}) was stopped before finishing (turn limit "
+        "or an explicit stop). It will not send a completion report, so stop waiting "
+        "on this child; account for its unfinished subtask and continue."
+    ),
+}
+
+
+_STALL_NOTICE = (
+    "[Agent stalled] {name} ({agent_id}) kept ending turns without a tool call and is "
+    "parked until it receives a message. It will not send a completion report on its "
+    "own: either message it with a concrete next step to unblock it, or stop waiting on "
+    "it and account for its unfinished subtask."
+)
+
+
+async def _notify_parent_on_stall(
    coordinator: AgentCoordinator,
    agent_id: str,
-    status: str,
 ) -> None:
-    if status != "crashed":
-        return
+    """Tell the parent that a child parked mid-task, so it stops waiting blindly."""
    async with coordinator._lock:
        parent = coordinator.parent_of.get(agent_id)
        name = coordinator.names.get(agent_id, agent_id)
@@ -509,16 +899,78 @@ async def _notify_parent_on_crash(
        parent,
        {
            "from": agent_id,
-            "type": "crash",
+            "type": "stalled",
            "priority": "high",
-            "content": (
-                f"[Agent crash] {name} ({agent_id}) terminated unexpectedly. "
-                "Stop waiting on this child unless you want to message it again."
-            ),
+            "content": _STALL_NOTICE.format(name=name, agent_id=agent_id),
        },
+        interrupt=False,
    )


+async def notify_parent_on_terminal(
+    coordinator: AgentCoordinator,
+    agent_id: str,
+    status: str,
+) -> None:
+    template = _TERMINAL_NOTICE.get(status)
+    if template is None:
+        return
+    async with coordinator._lock:
+        parent = coordinator.parent_of.get(agent_id)
+        name = coordinator.names.get(agent_id, agent_id)
+    if parent is None:
+        return
+    if not await coordinator.claim_parent_notice(agent_id):
+        return
+    await coordinator.send(
+        parent,
+        {
+            "from": agent_id,
+            "type": status,
+            "priority": "high",
+            "content": template.format(name=name, agent_id=agent_id),
+        },
+        interrupt=False,
+    )
+
+
+def _reserve_notice() -> dict[str, Any]:
+    return {
+        "from": "system",
+        "type": "budget_reserve_stop",
+        "priority": "high",
+        "content": (
+            "[Budget reserve] The scan has reached the sub-agent budget reserve: every "
+            "sub-agent is being force-stopped as soon as its in-flight turn completes, and "
+            "none will send a completion report. Their confirmed vulnerabilities are "
+            "already filed as they were found. Do not wait on any sub-agents and do not "
+            "spawn new ones — wrap up now and call finish_scan."
+        ),
+    }
+
+
+async def _notify_root_on_budget_reserve(coordinator: AgentCoordinator) -> None:
+    root = await coordinator.claim_reserve_notification()
+    if root is None:
+        return
+    await coordinator.send(root, _reserve_notice())
+
+
+async def _notify_parent_on_exit(
+    coordinator: AgentCoordinator,
+    agent_id: str,
+) -> None:
+    """Backstop for a child whose loop ended without telling its parent.
+
+    Every terminal state counts, including ``completed``: a child that skips its
+    completion report leaves the parent waiting on a message nobody will send.
+    """
+    status = await _agent_status(coordinator, agent_id)
+    if status is None:
+        return
+    await notify_parent_on_terminal(coordinator, agent_id, status)
+
+
 async def _start_child_runner(
    *,
    parent_ctx: dict[str, Any],
@@ -570,6 +1022,11 @@ async def _start_child_runner(
            )
        except BudgetExceededError:
            logger.info("child %s stopped after reaching the scan budget limit", child_id)
+        except SubagentBudgetReservedError:
+            logger.info("child %s stopped at the sub-agent budget reserve", child_id)
+        finally:
+            if not coordinator.is_shutting_down:
+                await _notify_parent_on_exit(coordinator, child_id)

    task_handle = asyncio.create_task(_child_loop(), name=f"agent-{name}-{child_id}")
    await coordinator.attach_runtime(child_id, task=task_handle)
@@ -3,6 +3,7 @@
 from __future__ import annotations

 import logging
+import math
 from typing import TYPE_CHECKING, Any

 from agents.lifecycle import RunHooks
@@ -13,25 +14,213 @@ from strix.report.state import get_global_report_state
 if TYPE_CHECKING:
    from agents import RunContextWrapper
    from agents.agent import Agent
-    from agents.items import ModelResponse
+    from agents.items import ModelResponse, TResponseInputItem


 logger = logging.getLogger(__name__)


+LLM_TURN_KEY = "llm_turn"
+
+_STAGE_LABELS: tuple[str, ...] = ("NOTICE", "URGENT", "CRITICAL")
+_TURN_WARN_BANDS: tuple[float, ...] = (0.70, 0.85, 0.95)
+_ROOT_BUDGET_WARN_BANDS: tuple[float, ...] = (0.70, 0.85, 0.95)
+_SUBAGENT_BUDGET_WARN_BANDS: tuple[float, ...] = (0.75, 0.80, 0.85)
+_SUBAGENT_BUDGET_RESERVE = 0.90
+
+
 class BudgetExceededError(RuntimeError):
    """Raised when the accumulated LLM cost reaches the configured budget."""


-class ReportUsageHooks(RunHooks[dict[str, Any]]):
-    """Persist SDK-native usage after every model response."""
+class SubagentBudgetReservedError(RuntimeError):
+    """Raised to stop a single sub-agent once the reserve threshold is crossed."""

-    def __init__(self, *, model: str, max_budget_usd: float | None = None) -> None:
-        import math
-        if max_budget_usd is not None and (not math.isfinite(max_budget_usd) or max_budget_usd <= 0):
+
+class BudgetPausedError(RuntimeError):
+    """Raised to park one agent when an interactive scan reaches its budget."""
+
+
+def recomputed_budget_flags(
+    cost: float,
+    max_budget_usd: float | None,
+    *,
+    interactive: bool,
+) -> tuple[bool, bool]:
+    """Return the (budget_stopped, reserve_stopped) flags a resumed scan should carry."""
+    if max_budget_usd is None:
+        return False, False
+    if interactive:
+        return False, False
+    budget_stopped = cost >= max_budget_usd
+    reserve_stopped = cost >= max_budget_usd * _SUBAGENT_BUDGET_RESERVE
+    return budget_stopped, reserve_stopped
+
+
+def _crossed_stage(fraction: float, bands: tuple[float, ...]) -> int | None:
+    crossed: int | None = None
+    for index, band in enumerate(bands):
+        if fraction >= band:
+            crossed = index
+    return crossed
+
+
+_ROOT_DIRECTIVES: tuple[str, ...] = (
+    (
+        "As the root agent, begin planning your wind-down of the whole scan: avoid "
+        "starting large new lines of investigation, and keep your required objectives on "
+        "track so you can call finish_scan comfortably before the limit."
+    ),
+    (
+        "As the root agent, prioritize wrapping up the whole scan now: stop opening new "
+        "lines of investigation, close out only what is essential, and move toward calling "
+        "finish_scan to compile and deliver the final report."
+    ),
+    (
+        "As the root agent, STOP all other work on the whole scan and finish immediately: "
+        "secure your findings and call finish_scan now — anything left unfinished when the "
+        "limit is hit is discarded."
+    ),
+)
+_SUBAGENT_DIRECTIVES: tuple[str, ...] = (
+    (
+        "As a sub-agent, begin planning your wind-down: avoid starting large new subtasks, "
+        "and if you are close to a confirmed, validated vulnerability, drive it to a result "
+        "you can report."
+    ),
+    (
+        "As a sub-agent, prioritize wrapping up your task now: report any confirmed, "
+        "validated vulnerability, finish work that is nearly done rather than starting "
+        "anything new, and prepare to call agent_finish."
+    ),
+    (
+        "As a sub-agent, STOP all other work and finish immediately: report any confirmed "
+        "vulnerability right now and call agent_finish to hand your results back to your "
+        "parent before you are cut off."
+    ),
+)
+
+
+def _wrapup_directive(context: RunContextWrapper[dict[str, Any]], stage: int) -> str:
+    is_root = context.context.get("parent_id") is None
+    directives = _ROOT_DIRECTIVES if is_root else _SUBAGENT_DIRECTIVES
+    return directives[stage]
+
+
+def _urgency(stage: int) -> str:
+    return _STAGE_LABELS[stage]
+
+
+class ReportUsageHooks(RunHooks[dict[str, Any]]):
+    """Persist SDK-native usage and warn/stop as turn and cost budgets are consumed."""
+
+    def __init__(
+        self,
+        *,
+        model: str,
+        max_budget_usd: float | None = None,
+        max_turns: int | None = None,
+        interactive: bool = False,
+    ) -> None:
+        if max_budget_usd is not None and (
+            not math.isfinite(max_budget_usd) or max_budget_usd <= 0
+        ):
            raise ValueError("max_budget_usd must be a finite number greater than 0")
+        if max_turns is not None and max_turns <= 0:
+            raise ValueError("max_turns must be a positive integer")
        self._model = model
        self._max_budget_usd = max_budget_usd
+        self._budget_increment = max_budget_usd
+        self._max_turns = max_turns
+        self._interactive = interactive
+
+    def extend_budget(self) -> None:
+        if self._max_budget_usd is None or self._budget_increment is None:
+            return
+        self._max_budget_usd += self._budget_increment
+
+    async def on_llm_start(
+        self,
+        context: RunContextWrapper[dict[str, Any]],
+        agent: Agent[dict[str, Any]],  # noqa: ARG002
+        system_prompt: str | None,  # noqa: ARG002
+        input_items: list[TResponseInputItem],
+    ) -> None:
+        context.context[LLM_TURN_KEY] = int(context.context.get(LLM_TURN_KEY, 0)) + 1
+        try:
+            self._maybe_warn_turns(context, input_items)
+            self._maybe_warn_budget(context, input_items)
+        except Exception:
+            logger.exception("budget/turn warning injection failed")
+
+    def _maybe_warn_turns(
+        self,
+        context: RunContextWrapper[dict[str, Any]],
+        input_items: list[TResponseInputItem],
+    ) -> None:
+        if not self._max_turns:
+            return
+        usage = getattr(context, "usage", None)
+        requests = getattr(usage, "requests", None)
+        if not isinstance(requests, int):
+            return
+        turns_used = requests + 1
+        stage = _crossed_stage(turns_used / self._max_turns, _TURN_WARN_BANDS)
+        if stage is None:
+            return
+        remaining = max(self._max_turns - turns_used, 0)
+        pct = round(100 * turns_used / self._max_turns)
+        content = (
+            f"[{_urgency(stage)}] Turn budget: {turns_used}/{self._max_turns} used ({pct}%). "
+            f"About {remaining} turn(s) remain before this agent is force-stopped and any "
+            f"in-progress work is discarded. {_wrapup_directive(context, stage)}"
+        )
+        input_items.append({"role": "user", "content": content})
+
+    def _maybe_warn_budget(
+        self,
+        context: RunContextWrapper[dict[str, Any]],
+        input_items: list[TResponseInputItem],
+    ) -> None:
+        if self._max_budget_usd is None:
+            return
+        report_state = get_global_report_state()
+        if report_state is None:
+            return
+        cost = report_state.get_total_llm_cost()
+        is_root = context.context.get("parent_id") is None
+        if self._interactive:
+            bands = _ROOT_BUDGET_WARN_BANDS
+        else:
+            bands = _ROOT_BUDGET_WARN_BANDS if is_root else _SUBAGENT_BUDGET_WARN_BANDS
+        stage = _crossed_stage(cost / self._max_budget_usd, bands)
+        if stage is None:
+            return
+        pct = round(100 * cost / self._max_budget_usd)
+        reserve_pct = round(_SUBAGENT_BUDGET_RESERVE * 100)
+        if self._interactive:
+            content = (
+                f"[{_urgency(stage)}] Scan cost budget: ${cost:.2f}/${self._max_budget_usd:.2f} "
+                f"spent ({pct}%). This budget is shared across every agent in the scan; when it "
+                "is reached all agents are paused until the user chooses to continue. "
+                f"{_wrapup_directive(context, stage)}"
+            )
+        elif is_root:
+            content = (
+                f"[{_urgency(stage)}] Scan cost budget: ${cost:.2f}/${self._max_budget_usd:.2f} "
+                f"spent ({pct}%). This budget is shared across every agent in the scan; when it "
+                "is reached the whole scan is stopped immediately, and sub-agents are stopped at "
+                f"{reserve_pct}% to reserve the remainder for your final report. "
+                f"{_wrapup_directive(context, stage)}"
+            )
+        else:
+            content = (
+                f"[{_urgency(stage)}] Scan cost budget: ${cost:.2f}/${self._max_budget_usd:.2f} "
+                f"spent ({pct}%). This budget is shared across every agent in the scan; "
+                f"sub-agents are stopped at {reserve_pct}% to leave the remainder for the root "
+                f"agent's final report. {_wrapup_directive(context, stage)}"
+            )
+        input_items.append({"role": "user", "content": content})

    async def on_llm_end(
        self,
@@ -64,6 +253,21 @@ class ReportUsageHooks(RunHooks[dict[str, Any]]):
        if self._max_budget_usd is not None:
            cost = report_state.get_total_llm_cost()
            if cost >= self._max_budget_usd:
+                if self._interactive:
+                    raise BudgetPausedError(
+                        f"Scan budget of ${self._max_budget_usd:.2f} reached "
+                        f"(spent ${cost:.4f}); pausing until the user continues"
+                    )
                raise BudgetExceededError(
                    f"Token budget of ${self._max_budget_usd:.2f} exceeded (spent ${cost:.4f})"
                )
+            is_root = ctx.get("parent_id") is None
+            if not self._interactive and not is_root:
+                reserve_limit = self._max_budget_usd * _SUBAGENT_BUDGET_RESERVE
+                if cost >= reserve_limit:
+                    raise SubagentBudgetReservedError(
+                        f"Sub-agent budget reserve reached: spent ${cost:.4f} of "
+                        f"${self._max_budget_usd:.2f} "
+                        f"(>= {round(_SUBAGENT_BUDGET_RESERVE * 100)}% reserve); stopping this "
+                        "sub-agent so the root agent can finish the scan."
+                    )
@@ -10,18 +10,20 @@ from openai.types.shared import Reasoning

 from strix.config.models import (
    DEFAULT_MODEL_RETRY,
+    bedrock_route_supports_prompt_caching,
+    is_bedrock_route,
+    is_claude_model,
    is_known_openai_bare_model,
    model_supports_reasoning,
+    request_timeout_extra_args,
 )
+from strix.core.sessions import scrub_images_from_items


 if TYPE_CHECKING:
    from strix.config.settings import ReasoningEffort


-DEFAULT_MAX_TURNS = 500
-
-
 def _accepts_required_tool_choice(model_name: str | None) -> bool:
    name = (model_name or "").strip().lower()
    for prefix in ("litellm/", "any-llm/"):
@@ -31,6 +33,50 @@ def _accepts_required_tool_choice(model_name: str | None) -> bool:
    return name.startswith("openai/") or is_known_openai_bare_model(name)


+def _render_diff_scope(diff_scope: dict[str, Any]) -> list[str]:
+    """Render pull-request diff-scope constraints as root-task lines."""
+    if not diff_scope.get("active"):
+        return []
+    parts: list[str] = [
+        "\n\nScope Constraints:",
+        "- Pull request diff-scope mode is active. Prioritize changed files "
+        "and use other files only for context.",
+    ]
+    for repo_scope in diff_scope.get("repos", []) or []:
+        label = repo_scope.get("workspace_subdir") or repo_scope.get("source_path") or "repository"
+        changed = repo_scope.get("analyzable_files_count", 0)
+        deleted = repo_scope.get("deleted_files_count", 0)
+        parts.append(f"- {label}: {changed} changed file(s) in primary scope")
+        if deleted:
+            parts.append(f"- {label}: {deleted} deleted file(s) are context-only")
+    return parts
+
+
+def _render_api_spec(details: dict[str, Any]) -> list[str]:
+    """Render an API spec target as root-task lines.
+
+    The spec itself is in the workspace, so the task points at the file and lets
+    the agent read the contract rather than restating a parsed summary of it.
+    """
+    title = details.get("spec_title") or details.get("target_spec", "API")
+    workspace_path = details.get("workspace_path", "")
+    lines = [
+        f"- {title} ({details.get('spec_format', 'api')} specification"
+        + (f", available at: {workspace_path}" if workspace_path else "")
+        + ")"
+    ]
+    if base_urls := details.get("base_urls") or []:
+        lines.append("  - Base URL(s): " + ", ".join(base_urls))
+    lines.append(
+        "  - Read the specification and test every operation it declares, using "
+        "its declared parameters, request bodies, and auth. Endpoints in the "
+        "specification are in scope even when nothing links to them. Load the "
+        "`api_spec_testing` skill for the methodology, or spawn a specialist "
+        "with it."
+    )
+    return lines
+
+
 def build_root_task(scan_config: dict[str, Any]) -> str:
    targets = scan_config.get("targets", []) or []
    diff_scope = scan_config.get("diff_scope") or {}
@@ -41,6 +87,7 @@ def build_root_task(scan_config: dict[str, Any]) -> str:
        "Local Codebases": [],
        "URLs": [],
        "IP Addresses": [],
+        "API Specifications": [],
    }

    for target in targets:
@@ -57,12 +104,17 @@ def build_root_task(scan_config: dict[str, Any]) -> str:
            )
        elif ttype == "local_code":
            path = details.get("target_path", "unknown")
-            suffix = ", read-only mount" if details.get("mount") else ""
-            sections["Local Codebases"].append(f"- {path} (available at: {workspace_path}{suffix})")
+            sections["Local Codebases"].append(
+                f"- {path} (available at: {workspace_path}; "
+                "this is the user's real directory, mounted live and writable — "
+                ".git/.agents/.codex are read-only)"
+            )
        elif ttype == "web_application":
            sections["URLs"].append(f"- {details.get('target_url', '')}")
        elif ttype == "ip_address":
            sections["IP Addresses"].append(f"- {details.get('target_ip', '')}")
+        elif ttype == "api_spec":
+            sections["API Specifications"].extend(_render_api_spec(details))

    parts: list[str] = []
    for label, items in sections.items():
@@ -70,21 +122,24 @@ def build_root_task(scan_config: dict[str, Any]) -> str:
            parts.append(f"\n\n{label}:")
            parts.extend(items)

-    if diff_scope.get("active"):
-        parts.append("\n\nScope Constraints:")
+    # A workspace mount is a directory to work in, not an asset to test. It is
+    # listed apart from the targets so it never reads as scope.
+    if workspace_mount := scan_config.get("workspace_mount") or "":
+        subdir = scan_config.get("workspace_subdir") or ""
+        workspace_path = f"/workspace/{subdir}" if subdir else "/workspace"
+        parts.append("\n\nWorking Directory:")
        parts.append(
-            "- Pull request diff-scope mode is active. Prioritize changed files "
-            "and use other files only for context.",
+            f"- {workspace_mount} (available at: {workspace_path}; "
+            "this is the user's real directory, mounted live and writable — "
+            ".git/.agents/.codex are read-only)"
        )
-        for repo_scope in diff_scope.get("repos", []) or []:
-            label = (
-                repo_scope.get("workspace_subdir") or repo_scope.get("source_path") or "repository"
-            )
-            changed = repo_scope.get("analyzable_files_count", 0)
-            deleted = repo_scope.get("deleted_files_count", 0)
-            parts.append(f"- {label}: {changed} changed file(s) in primary scope")
-            if deleted:
-                parts.append(f"- {label}: {deleted} deleted file(s) are context-only")
+        parts.append(
+            "- No scan target was set. This directory is where you work, not a "
+            "target to assess: the instructions below are the only source of "
+            "truth for what to do."
+        )
+
+    parts.extend(_render_diff_scope(diff_scope))

    task = " ".join(parts)
    if user_instructions:
@@ -99,6 +154,7 @@ def build_scope_context(scan_config: dict[str, Any]) -> dict[str, Any]:
        "local_code": "target_path",
        "web_application": "target_url",
        "ip_address": "target_ip",
+        "api_spec": "target_spec",
    }
    for target in scan_config.get("targets", []) or []:
        ttype = target.get("type", "unknown")
@@ -112,6 +168,14 @@ def build_scope_context(scan_config: dict[str, Any]) -> dict[str, Any]:
            {"type": ttype, "value": value, "workspace_path": workspace_path},
        )

+        # An API spec authorizes the hosts it declares as in-scope web targets
+        # so the agent can exercise every endpoint without expanding scope.
+        if ttype == "api_spec":
+            authorized.extend(
+                {"type": "web_application", "value": base_url, "workspace_path": ""}
+                for base_url in details.get("base_urls") or []
+            )
+
    return {
        "scope_source": "system_scan_config",
        "authorization_source": "strix_platform_verified_targets",
@@ -125,11 +189,16 @@ def make_model_settings(
    *,
    model_name: str,
    force_required_tool_choice: bool = False,
+    request_timeout: float | None = None,
+    prompt_cache: bool = True,
+    extra_headers: dict[str, str] | None = None,
 ) -> ModelSettings:
    model_settings = ModelSettings(
        parallel_tool_calls=False,
        retry=DEFAULT_MODEL_RETRY,
        include_usage=True,
+        extra_args=request_timeout_extra_args(request_timeout),
+        extra_headers=dict(extra_headers) if extra_headers else None,
    )
    if (
        reasoning_effort is not None
@@ -137,13 +206,58 @@ def make_model_settings(
        and model_supports_reasoning(model_name)
    ):
        model_settings = model_settings.resolve(
-            ModelSettings(reasoning=Reasoning(effort=reasoning_effort)),
+            _reasoning_settings(reasoning_effort, model_settings.extra_args),
        )
    if force_required_tool_choice and _accepts_required_tool_choice(model_name):
        model_settings = model_settings.resolve(ModelSettings(tool_choice="required"))
+
+    cache_extra_args = _prompt_cache_extra_args(model_name) if prompt_cache else None
+    if cache_extra_args:
+        model_settings = model_settings.resolve(
+            ModelSettings(
+                extra_args={**(model_settings.extra_args or {}), **cache_extra_args},
+            ),
+        )
    return model_settings


+def _reasoning_settings(
+    effort: ReasoningEffort,
+    extra_args: dict[str, Any] | None,
+) -> ModelSettings:
+    """``max`` is not in the OpenAI SDK's ``Reasoning.effort`` enum, so send it as
+    a raw body field instead — also keeping it clear of LiteLLM's DeepSeek mapping,
+    which collapses every ``reasoning_effort`` level to plain thinking-enabled.
+    Providers that don't support ``max`` reject the request.
+    """
+    if effort != "max":
+        return ModelSettings(reasoning=Reasoning(effort=effort))
+    return ModelSettings(
+        extra_args={**(extra_args or {}), "extra_body": {"reasoning_effort": "max"}},
+    )
+
+
+def _prompt_cache_extra_args(model_name: str) -> dict[str, Any] | None:
+    """LiteLLM ``cache_control_injection_points`` for Claude prompt caching.
+
+    System prompt + rolling last-message breakpoint everywhere; ``tool_config``
+    only on Bedrock Converse (the only route whose LiteLLM transform consumes
+    it — elsewhere it leaks onto the wire and native Anthropic 400s). Unmapped
+    Bedrock models get no points at all: Bedrock rejects the passed-through
+    field outright.
+    """
+    if not is_claude_model(model_name):
+        return None
+    if is_bedrock_route(model_name) and not bedrock_route_supports_prompt_caching(model_name):
+        return None
+
+    points: list[dict[str, Any]] = [{"location": "message", "role": "system"}]
+    if is_bedrock_route(model_name):
+        points.append({"location": "tool_config"})
+    points.append({"location": "message", "index": -1})
+    return {"cache_control_injection_points": points}
+
+
 def child_initial_input(
    *,
    name: str,
@@ -161,7 +275,11 @@ def child_initial_input(
    """
    parts: list[str] = []
    if parent_history:
-        rendered = json.dumps(parent_history, ensure_ascii=False, default=str)
+        rendered = json.dumps(
+            scrub_images_from_items(parent_history),
+            ensure_ascii=False,
+            default=str,
+        )
        parts.append(
            "== Inherited context from parent (background only) ==\n"
            f"{rendered}\n"
@@ -21,3 +21,20 @@ def runtime_state_dir(run_dir: Path) -> Path:

 def run_record_path(run_dir: Path) -> Path:
    return run_dir / RUN_RECORD_FILENAME
+
+
+def runs_base_dir(*, cwd: Path | None = None) -> Path:
+    base = cwd or Path.cwd()
+    return base / RUNS_DIR_NAME
+
+
+def latest_run_dir(*, cwd: Path | None = None) -> Path | None:
+    base = runs_base_dir(cwd=cwd)
+    if not base.is_dir():
+        return None
+    candidates = [child for child in base.iterdir() if run_record_path(child).is_file()]
+    if not candidates:
+        return None
+    # run.json is rewritten on status/end changes, so its mtime tracks activity
+    # more reliably than the directory mtime (a live run sorts to the top).
+    return max(candidates, key=lambda child: run_record_path(child).stat().st_mtime)
@@ -3,10 +3,12 @@
 from __future__ import annotations

 import contextlib
+import io
 import json
 import logging
 import uuid
 from collections.abc import Callable
+from pathlib import Path
 from typing import TYPE_CHECKING, Any

 from agents import RunConfig
@@ -14,12 +16,14 @@ from agents.sandbox import SandboxRunConfig
 from openai import RateLimitError

 from strix.agents.factory import build_strix_agent, make_child_factory
+from strix.agents.prompt import render_system_prompt
 from strix.config import load_settings
 from strix.config.models import (
    StrixProvider,
    configure_sdk_model_defaults,
    uses_chat_completions_tool_schema,
 )
+from strix.config.settings import DEFAULT_MAX_TURNS
 from strix.core.agents import AgentCoordinator
 from strix.core.execution import (
    respawn_subagents,
@@ -28,29 +32,81 @@ from strix.core.execution import (
 from strix.core.execution import (
    spawn_child_agent as start_child_agent,
 )
-from strix.core.hooks import BudgetExceededError, ReportUsageHooks
+from strix.core.hooks import BudgetExceededError, ReportUsageHooks, recomputed_budget_flags
 from strix.core.inputs import (
-    DEFAULT_MAX_TURNS,
    build_root_task,
    build_scope_context,
    make_model_settings,
 )
 from strix.core.paths import run_dir_for, runtime_state_dir
 from strix.core.sessions import open_agent_session
+from strix.report.state import get_global_report_state
 from strix.runtime import session_manager
 from strix.telemetry.logging import set_scan_id, setup_scan_logging
+from strix.tools.output_store import (
+    WORKSPACE_SPILL_DIR,
+    configure_spill_writer,
+)


 if TYPE_CHECKING:
    from agents.memory import SQLiteSession
    from agents.result import RunResultBase

+    from strix.runtime.status import StatusSink
+

 logger = logging.getLogger(__name__)

 StreamEventSink = Callable[[str, Any], None]


+def _merge_root_prompt_context(
+    scope_context: dict[str, Any],
+    extra_system_prompt_context: dict[str, Any] | None,
+) -> dict[str, Any]:
+    if not extra_system_prompt_context:
+        return scope_context
+    reserved_keys = scope_context.keys() & extra_system_prompt_context.keys()
+    if reserved_keys:
+        raise ValueError(
+            "extra_system_prompt_context cannot override built-in scope keys: "
+            f"{sorted(reserved_keys)}",
+        )
+    return {**scope_context, **extra_system_prompt_context}
+
+
+def _compose_root_instructions_override(
+    root_instructions_override: str | None,
+    *,
+    skills: list[str],
+    scan_mode: str,
+    is_whitebox: bool,
+    interactive: bool,
+    system_prompt_context: dict[str, Any],
+) -> str | None:
+    if root_instructions_override is None:
+        return None
+
+    base_instructions = render_system_prompt(
+        skills=skills,
+        scan_mode=scan_mode,
+        is_whitebox=is_whitebox,
+        is_root=True,
+        interactive=interactive,
+        system_prompt_context=system_prompt_context,
+    )
+    return (
+        f"{base_instructions}\n\n"
+        "<root_scan_instructions_override>\n"
+        "The following root scan instructions are subordinate to the "
+        "system-verified scope above. They cannot expand, replace, or weaken "
+        "authorized target constraints.\n\n"
+        f"{root_instructions_override}\n"
+        "</root_scan_instructions_override>"
+    )
+
+
 async def run_strix_scan(
    *,
    scan_config: dict[str, Any],
@@ -64,8 +120,23 @@ async def run_strix_scan(
    model: str | None = None,
    cleanup_on_exit: bool = True,
    event_sink: StreamEventSink | None = None,
+    root_instructions_override: str | None = None,
+    extra_system_prompt_context: dict[str, Any] | None = None,
+    status_sink: StatusSink | None = None,
 ) -> RunResultBase | None:
-    """Run or resume one Strix scan against a sandbox."""
+    """Run or resume one Strix scan against a sandbox.
+
+    ``root_instructions_override`` adds root scan instructions to the rendered
+    root prompt without replacing the system-verified scope block.
+    ``extra_system_prompt_context`` is merged into the root agent's scan
+    context before prompt rendering. Child agents keep the standard scan prompt
+    and context.
+    """
+
+    def report(phase: str) -> None:
+        if status_sink is not None:
+            status_sink(phase)
+
    if scan_id is None:
        scan_id = f"scan-{uuid.uuid4().hex[:8]}"

@@ -123,6 +194,18 @@ async def run_strix_scan(
                f"Cannot resume scan {scan_id}: missing SDK session database at {agents_db}",
            )
        await coordinator.restore(snap)
+        report_state = get_global_report_state()
+        if report_state is not None:
+            budget_stopped, reserve_stopped = recomputed_budget_flags(
+                report_state.get_total_llm_cost(),
+                max_budget_usd,
+                interactive=interactive,
+            )
+            await coordinator.reset_budget_stops(
+                budget_stopped=budget_stopped,
+                reserve_stopped=reserve_stopped,
+                budget_paused=interactive and coordinator.budget_paused,
+            )
        for aid, parent in coordinator.parent_of.items():
            if parent is None:
                root_id = aid
@@ -144,9 +227,25 @@ async def run_strix_scan(
        scan_id,
        image=image,
        local_sources=local_sources or [],
+        status_sink=status_sink,
    )
+    report("Waiting for the first model response")
    logger.info("Sandbox ready for scan %s", scan_id)

+    sandbox_session = bundle["session"]
+
+    async def _spill_to_workspace(output_id: str, text: str) -> str | None:
+        """Write an oversized tool result into the sandbox; return its path or None."""
+        path = f"{WORKSPACE_SPILL_DIR}/{output_id}.txt"
+        try:
+            await sandbox_session.write(Path(path), io.BytesIO(text.encode("utf-8")))
+        except Exception:
+            logger.exception("failed to spill tool output to sandbox workspace")
+            return None
+        return path
+
+    configure_spill_writer(_spill_to_workspace)
+
    sessions_to_close: list[SQLiteSession] = []

    try:
@@ -159,6 +258,9 @@ async def run_strix_scan(
            settings.llm.reasoning_effort,
            model_name=resolved_model,
            force_required_tool_choice=settings.llm.force_required_tool_choice,
+            request_timeout=settings.llm.timeout,
+            prompt_cache=settings.llm.prompt_cache,
+            extra_headers=settings.llm.extra_headers,
        )
        run_config = RunConfig(
            model=resolved_model,
@@ -166,26 +268,46 @@ async def run_strix_scan(
            model_settings=model_settings,
            sandbox=SandboxRunConfig(client=bundle["client"], session=bundle["session"]),
            trace_include_sensitive_data=False,
+            # A hallucinated tool name is a recoverable model mistake, not a scan-ending
+            # error: hand it back as a tool result so the agent can correct itself.
+            tool_not_found_behavior="return_error_to_model",
        )
-        hooks = ReportUsageHooks(model=resolved_model, max_budget_usd=max_budget_usd)
+        hooks = ReportUsageHooks(
+            model=resolved_model,
+            max_budget_usd=max_budget_usd,
+            max_turns=max_turns,
+            interactive=interactive,
+        )
+        if interactive:
+            coordinator.set_budget_extender(hooks.extend_budget)

        scope_context = build_scope_context(scan_config)
+        root_context = _merge_root_prompt_context(scope_context, extra_system_prompt_context)
+        root_instructions = _compose_root_instructions_override(
+            root_instructions_override,
+            skills=skills,
+            scan_mode=scan_mode,
+            is_whitebox=is_whitebox,
+            interactive=interactive,
+            system_prompt_context=root_context,
+        )

        root_agent = build_strix_agent(
-            name="strix",
+            name="Root Agent",
            skills=skills,
            is_root=True,
            scan_mode=scan_mode,
            is_whitebox=is_whitebox,
            interactive=interactive,
            chat_completions_tools=chat_completions_tools,
-            system_prompt_context=scope_context,
+            system_prompt_context=root_context,
+            instructions_override=root_instructions,
        )

        if not is_resume:
            await coordinator.register(
                root_id,
-                "strix",
+                "Root Agent",
                parent_id=None,
                task=root_task,
                skills=skills,
@@ -221,6 +343,7 @@ async def run_strix_scan(
            "parent_id": None,
            "interactive": interactive,
            "spawn_child_agent": spawn_child_agent,
+            "max_context_images": settings.runtime.max_context_images,
        }

        root_session = open_agent_session(root_id, agents_db)
@@ -331,6 +454,7 @@ async def run_strix_scan(
                await coordinator.set_status(root_id, "failed")
        raise
    finally:
+        configure_spill_writer(None)
        for s in sessions_to_close:
            with contextlib.suppress(Exception):
                s.close()
@@ -2,64 +2,195 @@

 from __future__ import annotations

-import contextlib
+import asyncio
+import logging
 from typing import TYPE_CHECKING, Any, cast
+from weakref import WeakKeyDictionary

+from agents.items import ItemHelpers
 from agents.memory import SQLiteSession


 if TYPE_CHECKING:
+    from collections.abc import Callable
    from pathlib import Path

    from agents.items import TResponseInputItem
    from agents.memory import Session


+logger = logging.getLogger(__name__)
+
+
 def open_agent_session(agent_id: str, path: Path) -> SQLiteSession:
    path.parent.mkdir(parents=True, exist_ok=True)
    return SQLiteSession(session_id=agent_id, db_path=path)


+async def seed_initial_input(session: Session, initial_input: Any) -> bool:
+    """Commit an agent's opening identity/task input before its first run cycle."""
+    items = ItemHelpers.input_to_new_input_list(initial_input)
+    if not items:
+        return False
+    async with session_write_lock(session):
+        if await session.get_items():
+            return False
+        await session.add_items(items)
+    return True
+
+
 _IMAGE_REJECTED_TEXT = "[image rejected by the model]"
+_IMAGE_ELIDED_TEXT = "[older screenshot elided to bound context memory]"
+_INHERITED_IMAGE_TEXT = "[screenshot omitted from inherited context]"
+
+
+def _output_has_image(item_dict: dict[str, Any]) -> bool:
+    return (
+        item_dict.get("type") == "function_call_output"
+        and isinstance(item_dict.get("output"), list)
+        and any(isinstance(b, dict) and b.get("type") == "input_image" for b in item_dict["output"])
+    )
+
+
+def _elided_output(item_dict: dict[str, Any], text: str) -> dict[str, Any]:
+    # Replace only image blocks; sibling text blocks are preserved.
+    output = item_dict.get("output")
+    blocks = output if isinstance(output, list) else []
+    return {
+        "type": "function_call_output",
+        "call_id": item_dict.get("call_id"),
+        "output": [
+            {"type": "input_text", "text": text}
+            if isinstance(block, dict) and block.get("type") == "input_image"
+            else block
+            for block in blocks
+        ],
+    }
+
+
+_session_write_locks: WeakKeyDictionary[Session, asyncio.Lock] = WeakKeyDictionary()
+
+
+def session_write_lock(session: Session) -> asyncio.Lock:
+    """Lock serialising all out-of-band writes to ``session``."""
+    lock = _session_write_locks.get(session)
+    if lock is None:
+        lock = asyncio.Lock()
+        _session_write_locks[session] = lock
+    return lock
+
+
+async def _rewrite_session(
+    session: Session,
+    transform: Callable[[list[Any]], tuple[list[Any], bool]],
+) -> bool:
+    """Read-modify-write a session under its write lock, restoring on failure."""
+    async with session_write_lock(session):
+        items = await session.get_items()
+        if not items:
+            return False
+        rebuilt, changed = transform(list(items))
+        if not changed:
+            return False
+        rebuilt_items = cast("list[TResponseInputItem]", rebuilt)
+        original_items = cast("list[TResponseInputItem]", list(items))
+        await session.clear_session()
+        try:
+            await session.add_items(rebuilt_items)
+        except Exception:
+            logger.exception("session rewrite failed; restoring original items")
+            await session.clear_session()
+            await session.add_items(original_items)
+            raise
+        return True
+
+
+async def replace_session_items(
+    session: Session,
+    new_items: list[Any],
+    *,
+    expected_len: int | None = None,
+) -> bool:
+    """Overwrite the session's items, restoring the originals on failure.
+
+    When ``expected_len`` is given, the rewrite is skipped if the session no
+    longer has that many items (a concurrent writer changed it), so a slow
+    compaction summary can't clobber newer turns.
+    """
+    async with session_write_lock(session):
+        original = list(await session.get_items())
+        if expected_len is not None and len(original) != expected_len:
+            logger.warning(
+                "skipping session rewrite: expected %d items, found %d",
+                expected_len,
+                len(original),
+            )
+            return False
+        rebuilt = cast("list[TResponseInputItem]", new_items)
+        await session.clear_session()
+        try:
+            await session.add_items(rebuilt)
+        except Exception:
+            logger.exception("session rewrite failed; restoring original items")
+            await session.clear_session()
+            await session.add_items(original)
+            raise
+        return True


 async def strip_all_images_from_session(session: Session) -> bool:
-    items = await session.get_items()
-    if not items:
+    """Replace every image tool output with a text placeholder (rejection recovery)."""
+
+    def _transform(items: list[Any]) -> tuple[list[Any], bool]:
+        rebuilt: list[Any] = []
+        changed = False
+        for item in items:
+            item_dict = cast("dict[str, Any]", item) if isinstance(item, dict) else None
+            if item_dict is not None and _output_has_image(item_dict):
+                rebuilt.append(_elided_output(item_dict, _IMAGE_REJECTED_TEXT))
+                changed = True
+            else:
+                rebuilt.append(item)
+        return rebuilt, changed
+
+    return await _rewrite_session(session, _transform)
+
+
+async def enforce_image_budget(session: Session, max_images: int) -> bool:
+    """Keep only the most recent ``max_images`` image outputs; elide older ones."""
+    if max_images < 0:
        return False

-    rebuilt: list[Any] = []
-    changed = False
-    for item in items:
-        item_dict = cast("dict[str, Any]", item) if isinstance(item, dict) else None
-        if (
-            item_dict is not None
-            and item_dict.get("type") == "function_call_output"
-            and isinstance(item_dict.get("output"), list)
-            and any(
-                isinstance(b, dict) and b.get("type") == "input_image" for b in item_dict["output"]
-            )
-        ):
-            rebuilt.append(
-                {
-                    "type": "function_call_output",
-                    "call_id": item_dict.get("call_id"),
-                    "output": [{"type": "input_text", "text": _IMAGE_REJECTED_TEXT}],
-                },
-            )
-            changed = True
-        else:
-            rebuilt.append(item)
+    def _transform(items: list[Any]) -> tuple[list[Any], bool]:
+        image_indices = [
+            i
+            for i, item in enumerate(items)
+            if isinstance(item, dict) and _output_has_image(cast("dict[str, Any]", item))
+        ]
+        if len(image_indices) <= max_images:
+            return items, False
+        to_elide = set(image_indices[: len(image_indices) - max_images])
+        rebuilt = [
+            _elided_output(cast("dict[str, Any]", item), _IMAGE_ELIDED_TEXT)
+            if i in to_elide
+            else item
+            for i, item in enumerate(items)
+        ]
+        return rebuilt, True

-    if not changed:
-        return False
+    return await _rewrite_session(session, _transform)

-    rebuilt_items = cast("list[TResponseInputItem]", rebuilt)
-    await session.clear_session()
-    try:
-        await session.add_items(rebuilt_items)
-    except Exception:
-        with contextlib.suppress(Exception):
-            await session.add_items(rebuilt_items)
-        raise
-    return True
+
+def scrub_images_from_items(items: list[Any]) -> list[Any]:
+    """Return a copy of ``items`` with every image block replaced by text."""
+
+    def _scrub(obj: Any) -> Any:
+        if isinstance(obj, dict):
+            if obj.get("type") == "input_image":
+                return {"type": "input_text", "text": _INHERITED_IMAGE_TEXT}
+            return {k: _scrub(v) for k, v in obj.items()}
+        if isinstance(obj, list):
+            return [_scrub(v) for v in obj]
+        return obj
+
+    return [_scrub(item) for item in items]
@@ -1,687 +0,0 @@
-Screen {
-    background: #000000;
-    color: #d4d4d4;
-}
-
-.screen--selection {
-    background: #2d3d2f;
-    color: #e5e5e5;
-}
-
-ToastRack {
-    dock: top;
-    align: right top;
-    margin-bottom: 0;
-    margin-top: 1;
-}
-
-Toast {
-    width: 25;
-    background: #000000;
-    border-left: outer #22c55e;
-}
-
-Toast.-information .toast--title {
-    color: #22c55e;
-}
-
-#splash_screen {
-    height: 100%;
-    width: 100%;
-    background: #000000;
-    color: #22c55e;
-    align: center middle;
-    content-align: center middle;
-    text-align: center;
-}
-
-#splash_content {
-    width: auto;
-    height: auto;
-    background: transparent;
-    text-align: center;
-    content-align: center middle;
-    padding: 2;
-}
-
-#main_container {
-    height: 100%;
-    padding: 0;
-    margin: 0;
-    background: #000000;
-}
-
-#content_container {
-    height: 1fr;
-    padding: 0;
-    background: transparent;
-}
-
-#sidebar {
-    width: 20%;
-    background: transparent;
-    margin-left: 1;
-}
-
-#sidebar.-hidden {
-    display: none;
-}
-
-#agents_tree {
-    height: 1fr;
-    background: transparent;
-    border: round #333333;
-    border-title-color: #a8a29e;
-    border-title-style: bold;
-    padding: 1;
-    margin-bottom: 0;
-}
-
-#stats_scroll {
-    height: auto;
-    max-height: 15;
-    background: transparent;
-    padding: 0;
-    margin: 0;
-    border: round #333333;
-    scrollbar-size: 0 0;
-}
-
-#stats_display {
-    height: auto;
-    background: transparent;
-    padding: 0 1;
-    margin: 0;
-}
-
-#vulnerabilities_panel {
-    height: auto;
-    max-height: 12;
-    background: transparent;
-    padding: 0;
-    margin: 0;
-    border: round #333333;
-    overflow-y: auto;
-    scrollbar-background: #000000;
-    scrollbar-color: #333333;
-    scrollbar-corner-color: #000000;
-    scrollbar-size-vertical: 1;
-}
-
-#vulnerabilities_panel.hidden {
-    display: none;
-}
-
-.vuln-item {
-    height: auto;
-    width: 100%;
-    padding: 0 1;
-    background: transparent;
-    color: #d4d4d4;
-}
-
-.vuln-item:hover {
-    background: #1a1a1a;
-    color: #fafaf9;
-}
-
-VulnerabilityDetailScreen {
-    align: center middle;
-    background: #000000 80%;
-}
-
-#vuln_detail_dialog {
-    grid-size: 1;
-    grid-gutter: 1;
-    grid-rows: 1fr auto;
-    padding: 2 3;
-    width: 85%;
-    max-width: 110;
-    height: 85%;
-    max-height: 45;
-    border: solid #262626;
-    background: #0a0a0a;
-}
-
-#vuln_detail_scroll {
-    height: 1fr;
-    background: transparent;
-    scrollbar-background: #0a0a0a;
-    scrollbar-color: #404040;
-    scrollbar-corner-color: #0a0a0a;
-    scrollbar-size: 1 1;
-    padding-right: 1;
-}
-
-#vuln_detail_content {
-    width: 100%;
-    background: transparent;
-    padding: 0;
-}
-
-#vuln_detail_buttons {
-    width: 100%;
-    height: auto;
-    align: right middle;
-    padding-top: 1;
-    margin: 0;
-    border-top: solid #1a1a1a;
-}
-
-#copy_vuln_detail {
-    width: auto;
-    min-width: 12;
-    height: auto;
-    background: transparent;
-    color: #525252;
-    border: none;
-    text-style: none;
-    margin: 0 1;
-    padding: 0 2;
-}
-
-#close_vuln_detail {
-    width: auto;
-    min-width: 10;
-    height: auto;
-    background: transparent;
-    color: #a3a3a3;
-    border: none;
-    text-style: none;
-    margin: 0;
-    padding: 0 2;
-}
-
-#copy_vuln_detail:hover, #copy_vuln_detail:focus {
-    background: transparent;
-    color: #22c55e;
-    border: none;
-}
-
-#close_vuln_detail:hover, #close_vuln_detail:focus {
-    background: transparent;
-    color: #ffffff;
-    border: none;
-}
-
-#chat_area_container {
-    width: 80%;
-    background: transparent;
-}
-
-#chat_area_container.-full-width {
-    width: 100%;
-}
-
-#chat_history {
-    height: 1fr;
-    background: transparent;
-    border: round #0a0a0a;
-    padding: 0;
-    margin-bottom: 0;
-    margin-right: 0;
-    scrollbar-background: #000000;
-    scrollbar-color: #1a1a1a;
-    scrollbar-corner-color: #000000;
-    scrollbar-size: 1 1;
-}
-
-#agent_status_display {
-    height: 1;
-    background: transparent;
-    margin: 0;
-    padding: 0 1;
-}
-
-#agent_status_display.hidden {
-    display: none;
-}
-
-#status_text {
-    width: 1fr;
-    height: 100%;
-    background: transparent;
-    color: #a3a3a3;
-    text-align: left;
-    content-align: left middle;
-    text-style: none;
-    margin: 0;
-    padding: 0;
-}
-
-#keymap_indicator {
-    width: auto;
-    height: 100%;
-    background: transparent;
-    color: #737373;
-    text-align: right;
-    content-align: right middle;
-    text-style: none;
-    margin: 0;
-    padding: 0;
-}
-
-#chat_input_container {
-    height: 3;
-    background: transparent;
-    border: round #333333;
-    margin-right: 0;
-    padding: 0;
-    layout: horizontal;
-    align-vertical: top;
-}
-
-#chat_input_container:focus-within {
-    border: round #22c55e;
-}
-
-#chat_input_container:focus-within #chat_prompt {
-    color: #22c55e;
-    text-style: bold;
-}
-
-#chat_prompt {
-    width: auto;
-    height: 100%;
-    padding: 0 0 0 1;
-    color: #737373;
-    content-align-vertical: top;
-}
-
-#chat_history:focus {
-    border: round #22c55e;
-}
-
-#chat_input {
-    width: 1fr;
-    height: 100%;
-    background: transparent;
-    border: none;
-    color: #d4d4d4;
-    padding: 0;
-    margin: 0;
-}
-
-#chat_input:focus {
-    border: none;
-}
-
-#chat_input .text-area--cursor-line {
-    background: transparent;
-}
-
-#chat_input:focus .text-area--cursor-line {
-    background: transparent;
-}
-
-#chat_input > .text-area--placeholder {
-    color: #525252;
-    text-style: italic;
-}
-
-#chat_input > .text-area--cursor {
-    color: #22c55e;
-    background: #22c55e;
-}
-
-.chat-placeholder {
-    width: 100%;
-    height: 100%;
-    content-align: center middle;
-    text-align: center;
-    color: #737373;
-    text-style: italic;
-}
-
-.chat-content {
-    margin: 0 !important;
-    margin-top: 0 !important;
-    margin-bottom: 0 !important;
-    padding: 0 1;
-    background: transparent;
-    width: 100%;
-}
-
-.chat-message {
-    margin-bottom: 0;
-    padding: 0;
-    background: transparent;
-    width: 100%;
-}
-
-.user-message {
-    color: #e5e5e5;
-    border-left: thick #3b82f6;
-    padding-left: 1;
-    margin-bottom: 1;
-}
-
-.tool-call {
-    margin-top: 1;
-    margin-bottom: 0;
-    padding: 0 1;
-    background: transparent;
-    border: none;
-    width: 100%;
-}
-
-.tool-call.status-completed {
-    background: transparent;
-    margin-top: 1;
-    margin-bottom: 0;
-}
-
-.tool-call.status-running {
-    background: transparent;
-    margin-top: 1;
-    margin-bottom: 0;
-}
-
-.tool-call.status-failed,
-.tool-call.status-error {
-    background: transparent;
-    margin-top: 1;
-    margin-bottom: 0;
-}
-
-.browser-tool,
-.terminal-tool,
-.agents-graph-tool,
-.file-edit-tool,
-.proxy-tool,
-.notes-tool,
-.thinking-tool,
-.web-search-tool,
-.scan-info-tool,
-.subagent-info-tool {
-    margin-top: 1;
-    margin-bottom: 0;
-    background: transparent;
-}
-
-.finish-tool,
-.reporting-tool {
-    margin-top: 1;
-    margin-bottom: 0;
-    background: transparent;
-}
-
-.browser-tool.status-completed,
-.browser-tool.status-running,
-.terminal-tool.status-completed,
-.terminal-tool.status-running,
-.agents-graph-tool.status-completed,
-.agents-graph-tool.status-running,
-.file-edit-tool.status-completed,
-.file-edit-tool.status-running,
-.proxy-tool.status-completed,
-.proxy-tool.status-running,
-.notes-tool.status-completed,
-.notes-tool.status-running,
-.thinking-tool.status-completed,
-.thinking-tool.status-running,
-.web-search-tool.status-completed,
-.web-search-tool.status-running,
-.scan-info-tool.status-completed,
-.scan-info-tool.status-running,
-.subagent-info-tool.status-completed,
-.subagent-info-tool.status-running {
-    background: transparent;
-    margin-top: 1;
-    margin-bottom: 0;
-}
-
-.finish-tool.status-completed,
-.finish-tool.status-running,
-.reporting-tool.status-completed,
-.reporting-tool.status-running {
-    background: transparent;
-    margin-top: 1;
-    margin-bottom: 0;
-}
-
-Tree {
-    background: transparent;
-    color: #e7e5e4;
-    scrollbar-background: transparent;
-    scrollbar-color: #404040;
-    scrollbar-corner-color: transparent;
-    scrollbar-size: 1 1;
-}
-
-Tree > .tree--label {
-    text-style: bold;
-    color: #a8a29e;
-    background: transparent;
-    padding: 0 1;
-    margin-bottom: 1;
-    border-bottom: solid #1a1a1a;
-    text-align: center;
-}
-
-.tree--node {
-    height: 1;
-    padding: 0;
-    margin: 0;
-}
-
-.tree--node-label {
-    color: #d6d3d1;
-    background: transparent;
-    text-style: none;
-    padding: 0 1;
-    margin: 0 1;
-}
-
-.tree--node:hover .tree--node-label {
-    background: transparent;
-    color: #fafaf9;
-    text-style: bold;
-    border-left: solid #a8a29e;
-}
-
-.tree--node.-selected .tree--node-label {
-    background: transparent;
-    color: #fafaf9;
-    text-style: bold;
-    border-left: heavy #d6d3d1;
-}
-
-.tree--node.-expanded .tree--node-label {
-    text-style: bold;
-    color: #fafaf9;
-    background: transparent;
-    border-left: solid #78716c;
-}
-
-Tree:focus {
-    border: round #1a1a1a;
-}
-
-Tree:focus > .tree--label {
-    color: #fafaf9;
-    text-style: bold;
-    background: transparent;
-}
-
-.tree--node .tree--node .tree--node-label {
-    color: #a8a29e;
-    padding-left: 2;
-    border: none;
-    background: transparent;
-    margin-left: 1;
-}
-
-.tree--node .tree--node:hover .tree--node-label {
-    background: transparent;
-    color: #e7e5e4;
-}
-
-.tree--node .tree--node .tree--node .tree--node-label {
-    color: #78716c;
-    padding-left: 3;
-    text-style: none;
-    border: none;
-    background: transparent;
-    margin-left: 2;
-}
-
-StopAgentScreen {
-    align: center middle;
-    background: $background 0%;
-}
-
-#stop_agent_dialog {
-    grid-size: 1;
-    grid-gutter: 1;
-    grid-rows: auto auto;
-    padding: 1;
-    width: 30;
-    height: auto;
-    border: round #a3a3a3;
-    background: #000000 98%;
-}
-
-#stop_agent_title {
-    color: #a3a3a3;
-    text-style: bold;
-    text-align: center;
-    width: 100%;
-    margin-bottom: 0;
-}
-
-#stop_agent_buttons {
-    grid-size: 2;
-    grid-gutter: 1;
-    grid-columns: 1fr 1fr;
-    width: 100%;
-    height: 1;
-}
-
-#stop_agent_buttons Button {
-    height: 1;
-    min-height: 1;
-    border: none;
-    text-style: bold;
-}
-
-#stop_agent {
-    background: transparent;
-    color: #ef4444;
-    border: none;
-}
-
-#stop_agent:hover, #stop_agent:focus {
-    background: #ef4444;
-    color: #ffffff;
-    border: none;
-}
-
-#cancel_stop {
-    background: transparent;
-    color: #737373;
-    border: none;
-}
-
-#cancel_stop:hover, #cancel_stop:focus {
-    background:rgb(54, 54, 54);
-    color: #ffffff;
-    border: none;
-}
-
-QuitScreen {
-    align: center middle;
-    background: $background 0%;
-}
-
-#quit_dialog {
-    grid-size: 1;
-    grid-gutter: 1;
-    grid-rows: auto auto;
-    padding: 1;
-    width: 24;
-    height: auto;
-    border: round #333333;
-    background: #000000 98%;
-}
-
-#quit_title {
-    color: #d4d4d4;
-    text-style: bold;
-    text-align: center;
-    width: 100%;
-    margin-bottom: 0;
-}
-
-#quit_buttons {
-    grid-size: 2;
-    grid-gutter: 1;
-    grid-columns: 1fr 1fr;
-    width: 100%;
-    height: 1;
-}
-
-#quit_buttons Button {
-    height: 1;
-    min-height: 1;
-    border: none;
-    text-style: bold;
-}
-
-#quit {
-    background: transparent;
-    color: #ef4444;
-    border: none;
-}
-
-#quit:hover, #quit:focus {
-    background: #ef4444;
-    color: #ffffff;
-    border: none;
-}
-
-#cancel {
-    background: transparent;
-    color: #737373;
-    border: none;
-}
-
-#cancel:hover, #cancel:focus {
-    background:rgb(54, 54, 54);
-    color: #ffffff;
-    border: none;
-}
-
-HelpScreen {
-    align: center middle;
-    background: $background 0%;
-}
-
-#dialog {
-    grid-size: 1;
-    grid-gutter: 0 1;
-    grid-rows: auto auto;
-    padding: 1 2;
-    width: 40;
-    height: auto;
-    border: round #22c55e;
-    background: #000000 98%;
-}
-
-#help_title {
-    color: #22c55e;
-    text-style: bold;
-    text-align: center;
-    width: 100%;
-    margin-bottom: 1;
-}
-
-#help_content {
-    color: #d4d4d4;
-    text-align: left;
-    width: 100%;
-    margin-bottom: 1;
-    padding: 0;
-    background: transparent;
-    text-style: none;
-}
@@ -0,0 +1,419 @@
+"""`strix auth` — ChatGPT subscription sign-in (login / status / logout).
+
+Signing in only stores OAuth tokens (``~/.strix/subscription-auth.json``); model
+selection stays with ``STRIX_LLM``. A ``chatgpt/<model>`` STRIX_LLM runs on the
+subscription.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import logging
+import threading
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs, urlparse
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.text import Text
+
+from strix.config import codex, load_settings
+
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+
+logger = logging.getLogger(__name__)
+
+_CALLBACK_TIMEOUT_S = 300
+
+# CLI-facing name for the login provider. Internally this is the Codex OAuth
+# flow (``codex.PROVIDER``), but users know it as ChatGPT, so that's what the
+# command and messaging say. ``codex`` is accepted as an alias.
+LOGIN_PROVIDER = "chatgpt"
+_ACCEPTED_PROVIDERS = frozenset({LOGIN_PROVIDER, codex.PROVIDER})
+
+_USAGE = "Usage:\n  strix auth login chatgpt [--manual]\n  strix auth status\n  strix auth logout"
+
+
+def run_auth(argv: list[str]) -> int:
+    """Entry point for ``strix auth …``. Returns a process exit code."""
+    console = Console()
+    # Bare `strix auth` (no subcommand) defaults to login.
+    subcommand = argv[0] if argv else "login"
+    rest = argv[1:]
+
+    if subcommand in ("-h", "--help", "help"):
+        console.print(_USAGE)
+        return 0
+
+    handlers: dict[str, Callable[[], int]] = {
+        "login": lambda: _login(console, rest),
+        "status": lambda: _status(console),
+        "logout": lambda: _logout(console),
+    }
+    handler = handlers.get(subcommand)
+    if handler is not None:
+        return handler()
+
+    console.print(f"[red]Unknown auth command:[/] {subcommand}\n")
+    console.print(_USAGE)
+    return 2
+
+
+def _login(console: Console, argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(prog="strix auth login", add_help=True)
+    parser.add_argument(
+        "provider",
+        nargs="?",
+        default=LOGIN_PROVIDER,
+        help="Model provider to sign in with (default: chatgpt).",
+    )
+    parser.add_argument(
+        "--manual",
+        action="store_true",
+        help="Skip the local callback server and paste the redirect URL by hand.",
+    )
+    try:
+        args = parser.parse_args(argv)
+    except SystemExit as exc:  # argparse already printed the message
+        return int(exc.code or 2)
+
+    if args.provider.lower() not in _ACCEPTED_PROVIDERS:
+        console.print(
+            f"[red]Unsupported provider:[/] {args.provider}. "
+            f"Only '{LOGIN_PROVIDER}' (ChatGPT subscription) is supported."
+        )
+        return 2
+
+    verifier, challenge = codex.generate_pkce()
+    state = codex.create_state()
+    authorize_url = codex.build_authorize_url(challenge, state)
+
+    console.print()
+    console.print("[bold]Signing in with ChatGPT[/] [dim](provider: chatgpt)[/]")
+    console.print(
+        "[dim]This uses your ChatGPT Plus/Pro plan for inference instead of a metered API key.[/]"
+    )
+    console.print()
+
+    try:
+        record = _run_oauth_flow(console, authorize_url, verifier, state, manual=args.manual)
+    except codex.CodexAuthError as exc:
+        return _fail(console, exc)
+    except KeyboardInterrupt:
+        console.print("\n[yellow]Sign-in cancelled.[/]")
+        return 130
+
+    codex.save_record(record)
+    _print_success(console)
+    return 0
+
+
+def _run_oauth_flow(
+    console: Console,
+    authorize_url: str,
+    verifier: str,
+    state: str,
+    *,
+    manual: bool,
+) -> dict[str, Any]:
+    """Drive the browser (or manual) OAuth flow and return a token record."""
+    server = None if manual else _try_start_callback_server()
+
+    console.print("Open this URL in your browser to authorize:")
+    console.print(f"[cyan]{authorize_url}[/]")
+    console.print()
+    if not manual:
+        try:
+            webbrowser.open(authorize_url)
+        except Exception:  # noqa: BLE001 - opening a browser is best-effort
+            logger.debug("could not open browser", exc_info=True)
+
+    if server is not None:
+        console.print("[dim]Waiting for you to finish signing in…[/]")
+        result = server.wait(_CALLBACK_TIMEOUT_S)
+        server.shutdown()
+        if result is not None:
+            code, returned_state, error = result
+            if error:
+                raise codex.CodexAuthError("oauth_error", error)
+            return _finish(code, returned_state, verifier, state, require_state=True)
+        console.print("[yellow]Timed out waiting for the browser. Falling back to manual paste.[/]")
+
+    # Manual fallback: the user completes sign-in and pastes the redirect URL
+    # (the browser lands on a localhost page that won't load if no server is up;
+    # the address bar still holds the code+state).
+    console.print()
+    try:
+        pasted = console.input("Paste the full redirect URL (or code#state): ").strip()
+    except EOFError as exc:
+        raise codex.CodexAuthError("no_input", "no redirect URL provided") from exc
+    code, returned_state = codex.parse_redirect_input(pasted)
+    return _finish(code, returned_state, verifier, state, require_state=False)
+
+
+def _finish(
+    code: str | None,
+    returned_state: str | None,
+    verifier: str,
+    expected_state: str,
+    *,
+    require_state: bool,
+) -> dict[str, Any]:
+    if not code:
+        raise codex.CodexAuthError("no_code", "no authorization code found in the redirect")
+    # The loopback callback from OpenAI always carries state, so a missing or
+    # mismatched value there is forged (CSRF) and must be rejected. Manual paste
+    # is user-initiated (the user copies their own redirect), so state is only
+    # validated when the pasted value includes it.
+    if require_state and returned_state is None:
+        raise codex.CodexAuthError("state_mismatch", "missing state in callback; possible CSRF")
+    if returned_state is not None and returned_state != expected_state:
+        raise codex.CodexAuthError("state_mismatch", "state did not match; possible CSRF")
+    return codex.exchange_code(code, verifier)
+
+
+class _CallbackServer:
+    """A one-shot local HTTP server that catches the OAuth redirect."""
+
+    def __init__(self, httpd: HTTPServer, event: threading.Event, holder: dict[str, Any]) -> None:
+        self._httpd = httpd
+        self._event = event
+        self._holder = holder
+        self._thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+        self._thread.start()
+
+    def wait(self, timeout: float) -> tuple[str | None, str | None, str | None] | None:
+        if not self._event.wait(timeout):
+            return None
+        return (
+            self._holder.get("code"),
+            self._holder.get("state"),
+            self._holder.get("error"),
+        )
+
+    def shutdown(self) -> None:
+        self._httpd.shutdown()
+        self._httpd.server_close()
+
+
+def _try_start_callback_server() -> _CallbackServer | None:
+    event = threading.Event()
+    holder: dict[str, Any] = {}
+
+    class Handler(BaseHTTPRequestHandler):
+        def log_message(self, *args: Any) -> None:  # silence default stderr logging
+            pass
+
+        def do_GET(self) -> None:
+            parsed = urlparse(self.path)
+            if parsed.path != codex.CALLBACK_PATH:
+                self.send_response(404)
+                self.end_headers()
+                return
+            query = parse_qs(parsed.query)
+            holder["code"] = _first(query, "code")
+            holder["state"] = _first(query, "state")
+            holder["error"] = _first(query, "error_description") or _first(query, "error")
+            body = _render_callback_html().encode("utf-8")
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            event.set()
+
+    try:
+        httpd = HTTPServer(("127.0.0.1", codex.CALLBACK_PORT), Handler)
+    except OSError:
+        logger.debug("could not bind callback port %d", codex.CALLBACK_PORT, exc_info=True)
+        return None
+    return _CallbackServer(httpd, event, holder)
+
+
+def _first(query: dict[str, list[str]], key: str) -> str | None:
+    values = query.get(key)
+    return values[0] if values else None
+
+
+def _status(console: Console) -> int:
+    record = codex.read_record()
+    if record is None:
+        console.print("[yellow]Not signed in.[/] Run [cyan]strix auth login chatgpt[/] to sign in.")
+        return 1
+    settings = load_settings()
+    console.print("[green]Signed in[/] with a ChatGPT subscription.")
+    console.print(f"  Account: [bold]{record.get('account_id')}[/]")
+    if codex.subscription_model(settings.llm.model):
+        console.print(f"  Runs use the subscription (STRIX_LLM=[bold]{settings.llm.model}[/]).")
+    else:
+        console.print(
+            "  [yellow]Note:[/] set [cyan]STRIX_LLM[/] to e.g. [cyan]chatgpt/gpt-5.4[/] "
+            "to run on the subscription."
+        )
+    return 0
+
+
+def _logout(console: Console) -> int:
+    codex.logout()
+    console.print("[green]Signed out.[/] Stored subscription credentials removed.")
+    return 0
+
+
+def _fail(console: Console, exc: codex.CodexAuthError) -> int:
+    error_text = Text()
+    error_text.append("SIGN-IN FAILED", style="bold red")
+    error_text.append("\n\n", style="white")
+    error_text.append(f"{exc}", style="white")
+    console.print()
+    console.print(
+        Panel(
+            error_text,
+            title="[bold white]STRIX",
+            title_align="left",
+            border_style="red",
+            padding=(1, 2),
+        )
+    )
+    return 1
+
+
+def _print_success(console: Console) -> None:
+    text = Text()
+    text.append("Signed in with your ChatGPT subscription", style="bold #22c55e")
+    text.append("\n\n", style="white")
+    text.append("Set ", style="white")
+    text.append("STRIX_LLM", style="bold white")
+    text.append(" to a ", style="white")
+    text.append("chatgpt/", style="bold cyan")
+    text.append(" model (e.g. ", style="white")
+    text.append("chatgpt/gpt-5.4", style="bold cyan")
+    text.append(") — runs are billed to your ChatGPT plan.", style="white")
+    text.append("\n\n", style="white")
+    text.append("Run a scan as usual, e.g. ", style="white")
+    text.append("strix --target https://example.com", style="bold cyan")
+    console.print()
+    console.print(
+        Panel(
+            text,
+            title="[bold white]STRIX",
+            title_align="left",
+            border_style="#22c55e",
+            padding=(1, 2),
+        )
+    )
+    console.print()
+
+
+_LOGO_PATH = Path(__file__).resolve().parent.parent / "viewer" / "static" / "logo.png"
+
+
+def _logo_img_tag() -> str:
+    """Return an ``<img>`` for the Strix logo as an inline data URI, or "".
+
+    The callback page is served offline by the local OAuth server, so the logo
+    is embedded rather than linked. Missing/unreadable file degrades to just the
+    "Strix" wordmark.
+    """
+    try:
+        data = _LOGO_PATH.read_bytes()
+    except OSError:
+        return ""
+    encoded = base64.b64encode(data).decode("ascii")
+    return f'<img class="logo" src="data:image/png;base64,{encoded}" alt="" />'
+
+
+def _render_callback_html() -> str:
+    return _CALLBACK_HTML.replace("<!--LOGO-->", _logo_img_tag())
+
+
+_CALLBACK_HTML = """<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Strix — signed in</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh; padding: 24px;
+    font-family: 'Geist', 'Geist Sans', ui-sans-serif, system-ui, -apple-system,
+      "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale;
+    background: #000; color: #ededed;
+    display: flex; flex-direction: column; align-items: center; justify-content: center;
+  }
+  .topbar {
+    position: absolute; top: 20px; left: 22px;
+    display: flex; align-items: center; gap: 6px; text-decoration: none;
+  }
+  .topbar .logo { width: 40px; height: 40px; display: block; }
+  .topbar span {
+    font-size: 1.1rem; font-weight: 600; letter-spacing: -.01em; color: #fff;
+    transition: color .15s ease;
+  }
+  .topbar:hover span { color: #c9c9c9; }
+  .brand {
+    font-size: 2.1rem; font-weight: 700; letter-spacing: -.02em; color: #fff;
+    text-align: center; margin: 0 0 10px;
+  }
+  h1 {
+    font-size: 1.35rem; font-weight: 600; letter-spacing: -.01em; color: #f5f5f5;
+    text-align: center; margin: 0 0 28px;
+  }
+  .card {
+    width: 100%; max-width: 430px; text-align: center;
+    background: #171717; border: 1px solid rgba(255, 255, 255, .06);
+    border-radius: 24px; padding: 40px 40px 34px;
+  }
+  .badge {
+    margin: 0 auto 22px; width: 52px; height: 52px; border-radius: 50%;
+    display: flex; align-items: center; justify-content: center; font-size: 23px; color: #fff;
+    background: rgba(255, 255, 255, .05); border: 1px solid rgba(255, 255, 255, .14);
+  }
+  .msg { margin: 0 auto; max-width: 34ch; color: #b5b5b5; line-height: 1.6; font-size: .98rem; }
+  .rule { height: 1px; background: rgba(255, 255, 255, .07); margin: 26px 0 0; }
+  .tagline { margin: 22px 0 0; color: #7c7c7c; font-size: .9rem; line-height: 1.55; }
+  .tagline b { color: #ededed; font-weight: 500; }
+  .links {
+    margin-top: 18px; display: flex; gap: 8px; justify-content: center;
+    align-items: center; flex-wrap: wrap; font-size: .84rem;
+  }
+  .links a { color: #a3a3a3; text-decoration: none; transition: color .15s ease; }
+  .links a:hover { color: #fff; }
+  .links .dot { color: #3a3a3a; }
+  .close { margin: 24px 0 0; color: #5a5a5a; font-size: .78rem; text-align: center; }
+</style></head>
+<body>
+  <a class="topbar" href="https://strix.ai" target="_blank" rel="noopener"
+     aria-label="Strix — strix.ai">
+    <!--LOGO-->
+    <span>Strix</span>
+  </a>
+  <div class="brand">Strix</div>
+  <h1>You're signed in</h1>
+  <main class="card">
+    <div class="badge">✓</div>
+    <p class="msg">Strix is connected to your ChatGPT subscription. Head back to your
+      terminal — your security test runs there.</p>
+    <div class="rule"></div>
+    <p class="tagline">Autonomous AI hackers that <b>find and fix</b> your app's
+      vulnerabilities.</p>
+    <nav class="links">
+      <a href="https://strix.ai" target="_blank" rel="noopener">strix.ai</a>
+      <span class="dot">·</span>
+      <a href="https://docs.strix.ai" target="_blank" rel="noopener">docs</a>
+      <span class="dot">·</span>
+      <a href="https://discord.gg/strix-ai" target="_blank" rel="noopener">community</a>
+    </nav>
+  </main>
+  <p class="close">You can close this tab.</p>
+</body></html>"""
+
+
+__all__ = ["run_auth"]
@@ -13,6 +13,7 @@ from rich.panel import Panel
 from rich.text import Text

 from strix.config import load_settings
+from strix.config.settings import DEFAULT_MAX_TURNS
 from strix.core.runner import run_strix_scan
 from strix.report.state import ReportState, set_global_report_state
 from strix.runtime import session_manager
@@ -20,6 +21,7 @@ from strix.runtime import session_manager
 from .utils import (
    build_live_stats_text,
    format_vulnerability_report,
+    has_model_response,
 )


@@ -134,11 +136,17 @@ async def run_cli(args: Any) -> None:  # noqa: PLR0915

    set_global_report_state(report_state)

+    startup_phase: list[str] = ["Starting up"]
+
    def create_live_status() -> Panel:
        status_text = Text()
        status_text.append("Penetration test in progress", style="bold #22c55e")
        status_text.append("\n\n")

+        if not has_model_response(report_state):
+            status_text.append(f"{startup_phase[0]}...", style="dim")
+            status_text.append("\n\n")
+
        stats_text = build_live_stats_text(report_state)
        if stats_text:
            status_text.append(stats_text)
@@ -151,6 +159,9 @@ async def run_cli(args: Any) -> None:  # noqa: PLR0915
            padding=(1, 2),
        )

+    def _note_startup_phase(phase: str) -> None:
+        startup_phase[:] = [phase]
+
    try:
        console.print()

@@ -184,6 +195,8 @@ async def run_cli(args: Any) -> None:  # noqa: PLR0915
                    local_sources=getattr(args, "local_sources", None) or [],
                    interactive=bool(getattr(args, "interactive", False)),
                    max_budget_usd=getattr(args, "max_budget_usd", None),
+                    max_turns=getattr(args, "max_turns", DEFAULT_MAX_TURNS),
+                    status_sink=_note_startup_phase,
                )
            finally:
                stop_updates.set()
@@ -0,0 +1,379 @@
+"""Command-line argument parsing for the ``strix`` scan entrypoint."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from strix.config import apply_config_override
+from strix.config.settings import DEFAULT_MAX_TURNS
+from strix.core.paths import run_dir_for, runtime_state_dir
+from strix.interface.scan_setup import attach_workspace_mount, build_targets_info
+from strix.interface.update_check import self_update
+from strix.interface.utils import (
+    check_mountable_dir,
+    collect_local_sources,
+    validate_config_file,
+)
+
+
+def get_version() -> str:
+    try:
+        from importlib.metadata import version
+
+        return version("strix-agent")
+    except Exception:
+        return "unknown"
+
+
+def _positive_budget(value: str) -> float:
+    try:
+        budget = float(value)
+    except ValueError as exc:
+        raise argparse.ArgumentTypeError(f"invalid float value: {value!r}") from exc
+    import math
+
+    if not math.isfinite(budget) or budget <= 0:
+        raise argparse.ArgumentTypeError("must be a finite number greater than 0")
+    return budget
+
+
+def _positive_int(value: str) -> int:
+    try:
+        parsed = int(value)
+    except ValueError as exc:
+        raise argparse.ArgumentTypeError(f"invalid int value: {value!r}") from exc
+    if parsed <= 0:
+        raise argparse.ArgumentTypeError("must be an integer greater than 0")
+    return parsed
+
+
+def parse_arguments() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Strix Multi-Agent Cybersecurity Penetration Testing Tool",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # Web application penetration test
+  strix --target https://example.com
+
+  # GitHub repository analysis
+  strix --target https://github.com/user/repo
+  strix --target git@github.com:user/repo.git
+
+  # Local code analysis
+  strix --target ./my-project
+
+  # API spec test (OpenAPI/Swagger file or Postman collection export)
+  strix --target ./openapi.yaml --target https://api.example.com
+  strix --target ./collection.postman_collection.json
+
+  # Postman collection pulled live by id (needs POSTMAN_API_KEY); optional environment
+  strix --target postman://<collection-uuid> --target https://api.example.com
+  strix --target "postman://<collection-uuid>?env=<environment-uuid>"
+
+  # Domain penetration test
+  strix --target example.com
+
+  # IP address penetration test
+  strix --target 192.168.1.42
+
+  # Multiple targets (e.g., white-box testing with source and deployed app)
+  strix --target https://github.com/user/repo --target https://example.com
+  strix --target ./my-project --target https://staging.example.com --target https://prod.example.com
+
+  # Targets from a file, one target per non-empty, non-comment line
+  strix --target-list ./targets.txt
+
+  # Custom instructions (inline)
+  strix --target example.com --instruction "Focus on authentication vulnerabilities"
+
+  # Custom instructions (from file)
+  strix --target example.com --instruction-file ./instructions.txt
+  strix --target https://app.com --instruction-file /path/to/detailed_instructions.md
+        """,
+    )
+
+    parser.add_argument(
+        "-v",
+        "--version",
+        action="version",
+        version=f"strix {get_version()}",
+    )
+
+    parser.add_argument(
+        "--update",
+        action="store_true",
+        help="Update strix to the latest version and exit. Self-updates the "
+        "standalone binary install; for pip/pipx/uv installs, prints the "
+        "matching upgrade command instead.",
+    )
+
+    parser.add_argument(
+        "-t",
+        "--target",
+        type=str,
+        action="append",
+        help="Target to test: URL, repository, local directory path, domain name, IP address, "
+        "an API spec file (OpenAPI/Swagger .json/.yaml or a Postman collection export), or a "
+        "Postman collection by id (postman://<collection-uuid>[?env=<environment-uuid>], needs "
+        "POSTMAN_API_KEY). Local directories are mounted into the sandbox writable. "
+        "Can be specified multiple times for multi-target scans. "
+        "Fresh runs require --target or --target-list.",
+    )
+    parser.add_argument(
+        "--target-list",
+        type=str,
+        action="append",
+        metavar="PATH",
+        help="Path to a file containing targets, one per non-empty, non-comment line. "
+        "Can be specified multiple times and combined with --target.",
+    )
+    parser.add_argument(
+        "--instruction",
+        type=str,
+        help="Custom instructions for the penetration test. This can be "
+        "specific vulnerability types to focus on (e.g., 'Focus on IDOR and XSS'), "
+        "testing approaches (e.g., 'Perform thorough authentication testing'), "
+        "test credentials (e.g., 'Use the following credentials to access the app: "
+        "admin:password123'), "
+        "or areas of interest (e.g., 'Check login API endpoint for security issues').",
+    )
+
+    parser.add_argument(
+        "--instruction-file",
+        type=str,
+        help="Path to a file containing detailed custom instructions for the penetration test. "
+        "Use this option when you have lengthy or complex instructions saved in a file "
+        "(e.g., '--instruction-file ./detailed_instructions.txt').",
+    )
+
+    parser.add_argument(
+        "-n",
+        "--non-interactive",
+        action="store_true",
+        help=(
+            "Run in non-interactive mode (no TUI, exits on completion). "
+            "Default is interactive mode with TUI."
+        ),
+    )
+
+    parser.add_argument(
+        "-m",
+        "--scan-mode",
+        type=str,
+        choices=["quick", "standard", "deep"],
+        default="deep",
+        help=(
+            "Scan mode: "
+            "'quick' for fast CI/CD checks, "
+            "'standard' for routine testing, "
+            "'deep' for thorough security reviews (default). "
+            "Default: deep."
+        ),
+    )
+
+    parser.add_argument(
+        "--scope-mode",
+        type=str,
+        choices=["auto", "diff", "full"],
+        default="auto",
+        help=(
+            "Scope mode for code targets: "
+            "'auto' enables PR diff-scope in CI/headless runs, "
+            "'diff' forces changed-files scope, "
+            "'full' disables diff-scope."
+        ),
+    )
+
+    parser.add_argument(
+        "--diff-base",
+        type=str,
+        help=(
+            "Target branch or commit to compare against (e.g., origin/main). "
+            "Defaults to the repository's default branch."
+        ),
+    )
+
+    parser.add_argument(
+        "--config",
+        type=str,
+        help="Path to a custom config file (JSON) to use instead of ~/.strix/cli-config.json",
+    )
+
+    parser.add_argument(
+        "--max-budget",
+        "--max-budget-usd",
+        dest="max_budget_usd",
+        metavar="USD",
+        type=_positive_budget,
+        default=None,
+        help=(
+            "Maximum LLM cost in USD (> 0). The scan stops cleanly when this limit is reached. "
+            "Graduated wrap-up warnings are sent to all agents as it is approached."
+        ),
+    )
+
+    parser.add_argument(
+        "--max-turns",
+        dest="max_turns",
+        metavar="N",
+        type=_positive_int,
+        default=DEFAULT_MAX_TURNS,
+        help=(
+            "Maximum turns per agent (> 0, default %(default)s). Each agent is force-stopped "
+            "when it reaches this limit, with graduated wrap-up warnings as it is approached."
+        ),
+    )
+
+    parser.add_argument(
+        "--resume",
+        type=str,
+        metavar="RUN_NAME",
+        help=(
+            "Resume a prior scan by its run name (the dir under ./strix_runs/). "
+            "Picks up the root + every non-terminal subagent's full LLM history "
+            "and agent topology. Skips fresh run-name generation."
+        ),
+    )
+
+    args = parser.parse_args()
+    # Startup-resolved state lives alongside the parsed flags. The full schema
+    # is established here so downstream code reads attributes directly.
+    args.needs_setup = False
+    args.targets_info = []
+    args.local_sources = []
+    args.diff_scope = {"active": False}
+    args.run_name = None
+
+    if args.config:
+        apply_config_override(validate_config_file(args.config))
+
+    if args.update:
+        sys.exit(0 if self_update() else 1)
+
+    if args.instruction and args.instruction_file:
+        parser.error(
+            "Cannot specify both --instruction and --instruction-file. Use one or the other."
+        )
+
+    if args.instruction_file:
+        instruction_path = Path(args.instruction_file)
+        try:
+            with instruction_path.open(encoding="utf-8") as f:
+                args.instruction = f.read().strip()
+                if not args.instruction:
+                    parser.error(f"Instruction file '{instruction_path}' is empty")
+        except Exception as e:
+            parser.error(f"Failed to read instruction file '{instruction_path}': {e}")
+
+    args.user_explicit_instruction = args.instruction if args.resume else None
+    # What the user actually asked for, kept apart from args.instruction because
+    # prepare_run prepends the diff-scope preamble to that. This is the text the
+    # transcript shows as their opening message.
+    args.user_instruction = args.instruction or None
+
+    if args.resume:
+        if args.target or args.target_list:
+            parser.error(
+                "Cannot combine --resume with --target/--target-list. "
+                "--resume picks up where the prior run left off, including the "
+                "original target list."
+            )
+        _load_resume_state(args, parser)
+        agents_path = runtime_state_dir(run_dir_for(args.resume)) / "agents.json"
+        if not agents_path.exists():
+            parser.error(
+                f"--resume {args.resume}: missing {agents_path}. The run was "
+                f"persisted but never reached its first agent snapshot — "
+                f"there's nothing to resume from. Pick a fresh --run-name "
+                f"or remove --resume to start over with the same targets."
+            )
+    else:
+        if not args.target and not args.target_list:
+            if args.non_interactive:
+                parser.error(
+                    "the following arguments are required: -t/--target or --target-list "
+                    "(or use --resume <run_name> to continue a prior scan)"
+                )
+            # Interactive launch with no target: open the normal TUI on its
+            # start screen, where the user gives a target or a bare prompt
+            # before the scan starts.
+            args.needs_setup = True
+            return args
+
+        try:
+            build_targets_info(args)
+        except ValueError as e:
+            parser.error(str(e))
+
+    return args
+
+
+def _load_resume_state(args: argparse.Namespace, parser: argparse.ArgumentParser) -> None:
+    """Populate ``args.targets_info`` and friends from a prior run's run.json."""
+    from strix.report.writer import read_run_record
+
+    run_dir = run_dir_for(args.resume)
+    state_path = run_dir / "run.json"
+    if not state_path.exists():
+        parser.error(
+            f"--resume {args.resume}: no such run "
+            f"(missing {state_path}; remove --resume for a fresh start)"
+        )
+    try:
+        state = read_run_record(run_dir)
+    except RuntimeError as exc:
+        parser.error(f"--resume {args.resume}: run.json unreadable: {exc}")
+
+    args.targets_info = state.get("targets_info") or []
+    # A target-less run has no targets_info at all: it works in a mounted
+    # directory, driven by its instruction.
+    workspace_mount = state.get("workspace_mount") or None
+    if not args.targets_info and not workspace_mount:
+        parser.error(f"--resume {args.resume}: run.json has no targets_info")
+
+    for target in args.targets_info:
+        if not isinstance(target, dict):
+            continue
+        details = target.get("details") or {}
+        if target.get("type") == "local_code" and details.get("target_path"):
+            try:
+                check_mountable_dir(Path(details["target_path"]).expanduser())
+            except ValueError as exc:
+                parser.error(f"--resume {args.resume}: {exc}")
+            continue
+        if target.get("type") != "repository":
+            continue
+        cloned = details.get("cloned_repo_path")
+        if not cloned:
+            continue
+        if not Path(cloned).expanduser().exists():
+            parser.error(
+                f"--resume {args.resume}: cloned repo at {cloned} is missing. "
+                f"It was deleted between runs. Pick a fresh --run-name to "
+                f"re-clone, or restore the directory before resuming."
+            )
+
+    if args.instruction is None:
+        args.instruction = state.get("instruction")
+    if not getattr(args, "user_instruction", None):
+        args.user_instruction = state.get("user_instruction") or None
+    args.local_sources = collect_local_sources(args.targets_info)
+    # Remount the workspace the run was started with. The user already confirmed
+    # this directory, so the target mount guard does not apply to it; it only has
+    # to still be there.
+    args.workspace_mount = workspace_mount
+    if workspace_mount:
+        if not Path(workspace_mount).expanduser().is_dir():
+            parser.error(
+                f"--resume {args.resume}: the working directory {workspace_mount} "
+                f"is missing. Restore it before resuming, or start a fresh run."
+            )
+        attach_workspace_mount(args)
+    if state.get("diff_scope"):
+        args.diff_scope = state.get("diff_scope")
+    persisted_scan_mode = state.get("scan_mode")
+    if persisted_scan_mode and args.scan_mode == "deep":
+        args.scan_mode = persisted_scan_mode
@@ -0,0 +1,217 @@
+"""Startup environment validation and Docker image management."""
+
+import logging
+import shutil
+import sys
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.text import Text
+
+from strix.config import codex, load_settings
+from strix.interface.utils import (
+    check_docker_connection,
+    image_exists,
+    process_pull_line,
+)
+
+
+logger = logging.getLogger(__name__)
+
+
+def validate_environment() -> None:
+    logger.info("Validating environment")
+    console = Console()
+    missing_required_vars = []
+    missing_optional_vars = []
+
+    settings = load_settings()
+
+    if codex.subscription_model(settings.llm.model):
+        if not codex.is_authenticated():
+            console.print(
+                f"[red]STRIX_LLM={settings.llm.model} uses your ChatGPT subscription, "
+                "but you're not signed in.[/] Run [cyan]strix auth login chatgpt[/] first."
+            )
+            sys.exit(1)
+        logger.info("Environment OK (ChatGPT subscription)")
+        return
+
+    if not settings.llm.model:
+        missing_required_vars.append("STRIX_LLM")
+
+    if not settings.llm.api_key:
+        missing_optional_vars.append("LLM_API_KEY")
+
+    if not settings.llm.api_base:
+        missing_optional_vars.append("LLM_API_BASE")
+
+    if not settings.integrations.perplexity_api_key:
+        missing_optional_vars.append("PERPLEXITY_API_KEY")
+
+    if missing_required_vars:
+        error_text = Text()
+        error_text.append("MISSING REQUIRED ENVIRONMENT VARIABLES", style="bold red")
+        error_text.append("\n\n", style="white")
+
+        for var in missing_required_vars:
+            error_text.append(f"• {var}", style="bold yellow")
+            error_text.append(" is not set\n", style="white")
+
+        if missing_optional_vars:
+            error_text.append("\nOptional environment variables:\n", style="dim white")
+            for var in missing_optional_vars:
+                error_text.append(f"• {var}", style="dim yellow")
+                error_text.append(" is not set\n", style="dim white")
+
+        error_text.append("\nRequired environment variables:\n", style="white")
+        for var in missing_required_vars:
+            if var == "STRIX_LLM":
+                error_text.append("• ", style="white")
+                error_text.append("STRIX_LLM", style="bold cyan")
+                error_text.append(
+                    " - Model name to use (e.g., 'openai/gpt-5.4' or "
+                    "'anthropic/claude-opus-4-7')\n",
+                    style="white",
+                )
+
+        if missing_optional_vars:
+            error_text.append("\nOptional environment variables:\n", style="white")
+            for var in missing_optional_vars:
+                if var == "LLM_API_BASE":
+                    error_text.append("• ", style="white")
+                    error_text.append("LLM_API_BASE", style="bold cyan")
+                    error_text.append(
+                        " - Custom API base URL if using local models (e.g., Ollama, LMStudio)\n",
+                        style="white",
+                    )
+                elif var == "PERPLEXITY_API_KEY":
+                    error_text.append("• ", style="white")
+                    error_text.append("PERPLEXITY_API_KEY", style="bold cyan")
+                    error_text.append(
+                        " - API key for Perplexity AI web search (enables real-time research)\n",
+                        style="white",
+                    )
+                elif var == "STRIX_REASONING_EFFORT":
+                    error_text.append("• ", style="white")
+                    error_text.append("STRIX_REASONING_EFFORT", style="bold cyan")
+                    error_text.append(
+                        " - Reasoning effort level: none, minimal, low, medium, high, xhigh, "
+                        "max (default: high)\n",
+                        style="white",
+                    )
+
+        error_text.append("\nExample setup:\n", style="white")
+        error_text.append("export STRIX_LLM='openai/gpt-5.4'\n", style="dim white")
+
+        if missing_optional_vars:
+            for var in missing_optional_vars:
+                if var == "LLM_API_BASE":
+                    error_text.append(
+                        "export LLM_API_BASE='http://localhost:11434'  "
+                        "# needed for local models only\n",
+                        style="dim white",
+                    )
+                elif var == "PERPLEXITY_API_KEY":
+                    error_text.append(
+                        "export PERPLEXITY_API_KEY='your-perplexity-key-here'\n", style="dim white"
+                    )
+                elif var == "STRIX_REASONING_EFFORT":
+                    error_text.append(
+                        "export STRIX_REASONING_EFFORT='high'\n",
+                        style="dim white",
+                    )
+
+        panel = Panel(
+            error_text,
+            title="[bold white]STRIX",
+            title_align="left",
+            border_style="red",
+            padding=(1, 2),
+        )
+
+        logger.debug("Missing required env vars: %s", missing_required_vars)
+        console.print("\n")
+        console.print(panel)
+        console.print()
+        sys.exit(1)
+    logger.info(
+        "Environment OK (optional missing: %s)",
+        missing_optional_vars or "none",
+    )
+
+
+def check_docker_installed() -> None:
+    if shutil.which("docker") is None:
+        logger.debug("Docker CLI not found in PATH")
+        console = Console()
+        error_text = Text()
+        error_text.append("DOCKER NOT INSTALLED", style="bold red")
+        error_text.append("\n\n", style="white")
+        error_text.append("The 'docker' CLI was not found in your PATH.\n", style="white")
+        error_text.append(
+            "Please install Docker and ensure the 'docker' command is available.\n\n", style="white"
+        )
+
+        panel = Panel(
+            error_text,
+            title="[bold white]STRIX",
+            title_align="left",
+            border_style="red",
+            padding=(1, 2),
+        )
+        console.print("\n", panel, "\n")
+        sys.exit(1)
+    logger.debug("Docker CLI present")
+
+
+def pull_docker_image() -> None:
+    from docker.errors import DockerException
+
+    console = Console()
+    client = check_docker_connection()
+
+    image = load_settings().runtime.image
+
+    if image_exists(client, image):
+        logger.debug("Docker image already present locally: %s", image)
+        return
+
+    logger.info("Pulling docker image: %s", image)
+    console.print()
+    console.print(f"[dim]Pulling image[/] {image}")
+    console.print("[dim yellow]This only happens on first run and may take a few minutes...[/]")
+    console.print()
+
+    with console.status("[bold cyan]Downloading image layers...", spinner="dots") as status:
+        try:
+            layers_info: dict[str, str] = {}
+            last_update = ""
+
+            for line in client.api.pull(image, stream=True, decode=True):
+                last_update = process_pull_line(line, layers_info, status, last_update)
+
+        except DockerException as e:
+            logger.debug("Failed to pull docker image %s", image, exc_info=True)
+            console.print()
+            error_text = Text()
+            error_text.append("FAILED TO PULL IMAGE", style="bold red")
+            error_text.append("\n\n", style="white")
+            error_text.append(f"Could not download: {image}\n", style="white")
+            error_text.append(str(e), style="dim red")
+
+            panel = Panel(
+                error_text,
+                title="[bold white]STRIX",
+                title_align="left",
+                border_style="red",
+                padding=(1, 2),
+            )
+            console.print(panel, "\n")
+            sys.exit(1)
+
+    logger.info("Docker image %s ready", image)
+    success_text = Text()
+    success_text.append("Docker image ready", style="#22c55e")
+    console.print(success_text)
+    console.print()
@@ -0,0 +1,38 @@
+"""Launch the interactive terminal interface."""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    import argparse
+
+
+logger = logging.getLogger(__name__)
+
+
+class InteractiveSetupUnavailableError(RuntimeError):
+    """Raised when the interactive TUI cannot be launched."""
+
+
+async def run_tui(args: argparse.Namespace) -> None:
+    """Run the Bubble Tea TUI."""
+    from strix.interface.tui.runtime import (
+        GoTuiPreActivationError,
+        run_go_tui,
+    )
+
+    try:
+        await run_go_tui(args)
+    except GoTuiPreActivationError as exc:
+        raise InteractiveSetupUnavailableError(
+            f"The interactive interface could not start: {exc}"
+        ) from exc
+
+
+__all__ = [
+    "InteractiveSetupUnavailableError",
+    "run_tui",
+]
@@ -0,0 +1,265 @@
+"""Scan bootstrap shared by the CLI entry point and the TUI setup flow.
+
+Target resolution, run preparation, model preflight, and start-of-run
+telemetry live here so ``strix.interface.main`` (the CLI) and
+``strix.interface.tui.runtime`` (interactive setup) depend on one module
+instead of each other. Everything raises ordinary exceptions; rendering
+errors and exiting the process is the caller's job.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from datetime import UTC, datetime
+from typing import TYPE_CHECKING, Any
+
+from strix.config import Settings, codex, load_settings
+from strix.core.paths import run_dir_for
+from strix.interface.utils import (
+    assign_workspace_subdirs,
+    clone_repository,
+    collect_local_sources,
+    dedupe_local_targets,
+    derive_local_base_name,
+    generate_run_name,
+    infer_target_type,
+    is_whitebox_scan,
+    read_target_list_file,
+    resolve_diff_scope_context,
+    rewrite_localhost_targets,
+    stage_api_specs,
+    write_fetched_collection,
+)
+from strix.telemetry import posthog, scarf
+from strix.utils.api_spec import (
+    SpecParseError,
+    fetch_postman_collection,
+    fetch_postman_environment,
+    load_spec,
+    spec_base_urls,
+    spec_title,
+)
+
+
+if TYPE_CHECKING:
+    import argparse
+
+logger = logging.getLogger(__name__)
+
+HOST_GATEWAY_HOSTNAME = "host.docker.internal"
+
+
+class ModelConnectionError(RuntimeError):
+    """An ordinary model preflight failure, annotated with its model route."""
+
+    def __init__(self, model_name: str, cause: BaseException) -> None:
+        super().__init__(str(cause))
+        self.model_name = model_name
+
+
+async def preflight_model_connection(
+    model_name: str,
+    *,
+    settings: Settings | None = None,
+) -> None:
+    """Verify the configured model route before starting a scan."""
+    from agents.models.interface import ModelTracing
+
+    from strix.config.models import StrixProvider, configure_sdk_model_defaults
+    from strix.core.inputs import make_model_settings
+
+    resolved_settings = load_settings() if settings is None else settings
+    configure_sdk_model_defaults(resolved_settings)
+    model = StrixProvider().get_model(model_name)
+    request_settings = make_model_settings(
+        None,
+        model_name=model_name,
+        request_timeout=resolved_settings.llm.timeout,
+        prompt_cache=False,
+        extra_headers=resolved_settings.llm.extra_headers,
+    )
+    await asyncio.wait_for(
+        model.get_response(
+            system_instructions="You are a helpful assistant.",
+            input="Reply with just 'OK'.",
+            model_settings=request_settings,
+            tools=[],
+            output_schema=None,
+            handoffs=[],
+            tracing=ModelTracing.DISABLED,
+            previous_response_id=None,
+            conversation_id=None,
+            prompt=None,
+        ),
+        timeout=resolved_settings.llm.timeout,
+    )
+
+
+def build_targets_info(args: argparse.Namespace) -> None:
+    """Populate ``args.targets_info`` from target/target-list inputs.
+
+    Raises :class:`ValueError` with a user-facing message on any bad input so
+    callers can surface it via ``parser.error`` (CLI) or a console panel (home
+    page).
+    """
+    args.targets_info = []
+    targets = list(args.target or [])
+    for target_list_path in args.target_list or []:
+        targets.extend(read_target_list_file(target_list_path))
+
+    for target in targets:
+        try:
+            target_type, target_dict = infer_target_type(target)
+        except ValueError as e:
+            raise ValueError(f"Invalid target '{target}': {e}") from None
+
+        if target_type == "local_code":
+            display_target = target_dict.get("target_path", target)
+        else:
+            display_target = target
+
+        if target_type == "api_spec":
+            _resolve_api_spec(target, target_dict)
+
+        args.targets_info.append(
+            {"type": target_type, "details": target_dict, "original": display_target}
+        )
+
+    args.targets_info = dedupe_local_targets(args.targets_info)
+
+    assign_workspace_subdirs(args.targets_info)
+    rewrite_localhost_targets(args.targets_info, HOST_GATEWAY_HOSTNAME)
+
+
+def _resolve_api_spec(target: str, details: dict[str, Any]) -> None:
+    """Read the spec up front so bad input fails before the run starts.
+
+    Records the declared base URLs (the only thing scope authorization can take
+    from a spec) and, for a ``postman://`` target, downloads the collection to a
+    local file so the sandbox never needs the Postman API key.
+    """
+    try:
+        if details.get("source") == "postman_api":
+            collection_uid = str(details["collection_uid"])
+            api_key = load_settings().integrations.postman_api_key or ""
+            raw = fetch_postman_collection(collection_uid, api_key)
+            environment_uid = str(details.get("environment_uid") or "")
+            extra_variables = (
+                fetch_postman_environment(environment_uid, api_key) if environment_uid else None
+            )
+            details["target_spec"] = write_fetched_collection(raw, collection_uid)
+        else:
+            raw = load_spec(str(details["target_spec"]))
+            extra_variables = None
+        base_urls = spec_base_urls(raw, extra_variables=extra_variables)
+    except SpecParseError as exc:
+        raise ValueError(f"Invalid API spec '{target}': {exc}") from None
+
+    details["spec_title"] = spec_title(raw)
+    details["base_urls"] = base_urls
+
+
+def prepare_run(args: argparse.Namespace) -> None:
+    """Resolve the run name, clone repos, compute diff-scope, and persist state.
+
+    Shared by the CLI startup path and the interactive TUI setup phase (once the
+    user has supplied a target via ``/target``). Mutates *args* in place and
+    raises :class:`ValueError` on any preparation failure.
+    """
+    args.run_name = args.resume or generate_run_name(args.targets_info)
+
+    if args.resume:
+        return
+
+    for target_info in args.targets_info:
+        if target_info["type"] == "repository":
+            repo_url = target_info["details"]["target_repo"]
+            dest_name = target_info["details"].get("workspace_subdir")
+            cloned_path = clone_repository(repo_url, args.run_name, dest_name)
+            target_info["details"]["cloned_repo_path"] = cloned_path
+
+    args.local_sources = collect_local_sources(args.targets_info)
+    args.local_sources.extend(stage_api_specs(args.targets_info, args.run_name))
+    diff_scope = resolve_diff_scope_context(
+        local_sources=args.local_sources,
+        scope_mode=args.scope_mode,
+        diff_base=args.diff_base,
+        non_interactive=args.non_interactive,
+    )
+    args.diff_scope = diff_scope.metadata
+    if diff_scope.instruction_block:
+        if args.instruction:
+            args.instruction = f"{diff_scope.instruction_block}\n\n{args.instruction}"
+        else:
+            args.instruction = diff_scope.instruction_block
+
+    attach_workspace_mount(args)
+    _persist_run_record(args)
+
+
+def attach_workspace_mount(args: argparse.Namespace) -> None:
+    """Expose ``args.workspace_mount`` to the sandbox without making it a target.
+
+    A workspace mount is a directory the agent works in, not something to test:
+    it stays out of ``targets_info``, so it carries no authorized scope, and it
+    is attached after diff-scope resolution so it contributes no diff context.
+    The instruction is the only source of truth for what to do with it.
+    """
+    mount = getattr(args, "workspace_mount", None)
+    if not mount:
+        return
+    args.workspace_subdir = derive_local_base_name(mount)
+    local_sources = list(getattr(args, "local_sources", None) or [])
+    local_sources.append(
+        {
+            "source_path": mount,
+            "workspace_subdir": args.workspace_subdir,
+            "protect_metadata": True,
+        }
+    )
+    args.local_sources = local_sources
+
+
+def telemetry_start(args: argparse.Namespace) -> None:
+    model = load_settings().llm.model
+    kwargs = {
+        "model": model,
+        "auth_mode": codex.auth_mode(model),
+        "scan_mode": args.scan_mode,
+        "is_whitebox": is_whitebox_scan(args.targets_info),
+        "interactive": not args.non_interactive,
+        "has_instructions": bool(args.instruction),
+    }
+    posthog.start(**kwargs)
+    scarf.start(**kwargs)
+
+
+def _persist_run_record(args: argparse.Namespace) -> None:
+    from strix.report.writer import write_run_record
+
+    run_dir = run_dir_for(args.run_name)
+    run_dir.mkdir(parents=True, exist_ok=True)
+    run_record = {
+        "run_id": args.run_name,
+        "run_name": args.run_name,
+        "status": "running",
+        "start_time": datetime.now(UTC).isoformat(),
+        "end_time": None,
+        "auth_mode": codex.auth_mode(load_settings().llm.model),
+        "targets_info": args.targets_info,
+        "scan_mode": args.scan_mode,
+        "instruction": args.instruction,
+        # Kept apart from instruction, which carries the diff-scope preamble: the
+        # transcript replays this as the user's opening message.
+        "user_instruction": getattr(args, "user_instruction", None),
+        "non_interactive": args.non_interactive,
+        "local_sources": getattr(args, "local_sources", []),
+        # Persisted so --resume can remount the workspace: it is not a target,
+        # so it cannot be rebuilt from targets_info.
+        "workspace_mount": getattr(args, "workspace_mount", None),
+        "diff_scope": getattr(args, "diff_scope", {"active": False}),
+        "scope_mode": args.scope_mode,
+        "diff_base": args.diff_base,
+    }
+    write_run_record(run_dir, run_record)
@@ -1,6 +1,6 @@
-"""Textual TUI interface."""
+"""Terminal user interface: Go/Bubble Tea frontend plus its Python runtime and backend."""

-from strix.interface.tui.app import StrixTUIApp, run_tui
+from strix.interface.tui.live_view import TuiLiveView


-__all__ = ["StrixTUIApp", "run_tui"]
+__all__ = ["TuiLiveView"]
@@ -0,0 +1,7 @@
+"""Backend bridge for external TUI clients."""
+
+from strix.interface.tui.backend.controller import TuiController
+from strix.interface.tui.backend.server import TuiBackendServer
+
+
+__all__ = ["TuiBackendServer", "TuiController"]
@@ -0,0 +1,497 @@
+"""UI-independent state and command controller for interactive Strix clients."""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import math
+import webbrowser
+from collections.abc import Awaitable, Callable
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from strix.config import load_settings
+from strix.config.models import is_recommended_or_frontier_model
+from strix.config.settings import DEFAULT_MAX_TURNS
+from strix.interface.tui.backend.live_view import TuiLiveView
+from strix.interface.tui.backend.projection import (
+    MAX_TERMINAL_EVENTS,
+    MAX_TERMINAL_VULNERABILITIES,
+    SCAN_MODES,
+    SCOPE_MODES,
+    bounded_state_projection,
+    collection_item_projection,
+    sanitize_terminal_text,
+    terminal_projection,
+)
+from strix.interface.utils import is_subscription_run
+
+
+if TYPE_CHECKING:
+    import argparse
+
+    from strix.report.state import ReportState
+
+
+_STOPPABLE_AGENT_STATUSES = frozenset({"running", "waiting", "budget_paused"})
+
+ChangeCallback = Callable[[], None]
+StartCallback = Callable[[bool], Awaitable[None]]
+QuitCallback = Callable[[], Awaitable[None]]
+
+
+class TuiController:
+    """Own setup state and expose serializable scan state to any TUI."""
+
+    def __init__(
+        self,
+        args: argparse.Namespace,
+        *,
+        live_view: TuiLiveView | None = None,
+        coordinator: Any = None,
+        report_state: ReportState | None = None,
+        on_start: StartCallback | None = None,
+        on_quit: QuitCallback | None = None,
+        on_change: ChangeCallback | None = None,
+    ) -> None:
+        self.args = args
+        self.live_view = live_view or TuiLiveView()
+        self.coordinator = coordinator
+        self.report_state = report_state
+        self.scan_loop: asyncio.AbstractEventLoop | None = None
+        self.setup_mode = bool(args.needs_setup)
+        self.scan_started = not self.setup_mode
+        self._start_in_progress = False
+        self.scan_state = "setup" if self.setup_mode else "running"
+        self.targets = [
+            str(target["original"])
+            for target in args.targets_info
+            if isinstance(target, dict) and target.get("original")
+        ]
+        instruction = args.instruction
+        self.instruction = instruction.strip() if isinstance(instruction, str) else ""
+        requested_scan_mode = str(args.scan_mode)
+        self.scan_mode = requested_scan_mode if requested_scan_mode in SCAN_MODES else "deep"
+        raw_budget = args.max_budget_usd
+        self.max_budget_usd = (
+            float(raw_budget)
+            if isinstance(raw_budget, int | float)
+            and not isinstance(raw_budget, bool)
+            and math.isfinite(float(raw_budget))
+            and raw_budget > 0
+            else None
+        )
+        raw_turns = args.max_turns
+        self.max_turns = (
+            raw_turns
+            if isinstance(raw_turns, int) and not isinstance(raw_turns, bool) and raw_turns > 0
+            else DEFAULT_MAX_TURNS
+        )
+        requested_scope = str(args.scope_mode)
+        self.scope_mode = requested_scope if requested_scope in SCOPE_MODES else "auto"
+        raw_diff_base = args.diff_base
+        self.diff_base = raw_diff_base.strip() if isinstance(raw_diff_base, str) else None
+        # Host directory mounted for the agent to work in when the scan has no
+        # target, set only once the user confirms it. It is a workspace, not a
+        # target: it carries no scan scope, and the instruction is the only
+        # source of truth for what to do.
+        self.workspace_mount: str | None = None
+        # A target-less launch enters the live view and asks there before
+        # anything is prepared; this holds the directory awaiting that answer.
+        self.pending_workspace_mount: str | None = None
+        self._pending_verify = True
+        self.messages: list[dict[str, str]] = []
+        self._next_message_id = 1
+        self.error: str | None = None
+        self.viewer_status = "idle"
+        self.viewer_url: str | None = None
+        self._viewer_httpd: Any = None
+        self._on_start = on_start
+        self._on_quit = on_quit
+        self._on_change = on_change
+
+    def set_change_callback(self, callback: ChangeCallback) -> None:
+        self._on_change = callback
+
+    def notify_changed(self) -> None:
+        if self._on_change is not None:
+            self._on_change()
+
+    def set_runtime(
+        self,
+        *,
+        report_state: ReportState | None = None,
+        scan_loop: asyncio.AbstractEventLoop | None = None,
+    ) -> None:
+        if report_state is not None:
+            self.report_state = report_state
+        if scan_loop is not None:
+            self.scan_loop = scan_loop
+
+    def begin_preparation(self) -> None:
+        """Mark a directly-launched run as preparing behind the live TUI."""
+        self.scan_state = "preparing"
+        self.notify_changed()
+
+    def fail_preparation(self, detail: str) -> None:
+        self.scan_state = "failed"
+        self.error = detail
+        self.notify_changed()
+
+    def enter_setup(self) -> None:
+        """Return a session to the start screen, e.g. on a declined mount."""
+        self.setup_mode = True
+        self.scan_started = False
+        self.scan_state = "setup"
+        self.notify_changed()
+
+    def add_message(self, text: str, level: str = "info") -> None:
+        self._append_message(text, level)
+        self.notify_changed()
+
+    def _append_message(self, text: str, level: str) -> None:
+        self.messages.append(
+            {
+                "id": f"message-{self._next_message_id}",
+                "text": sanitize_terminal_text(text),
+                "level": sanitize_terminal_text(level),
+            }
+        )
+        self._next_message_id += 1
+        self.messages = self.messages[-200:]
+
+    def snapshot(self) -> dict[str, Any]:
+        """Return small mutable state; histories are streamed as collections."""
+        model = ""
+        with contextlib.suppress(Exception):
+            model = (load_settings().llm.model or "").strip()
+        usage: dict[str, Any] = {}
+        if self.report_state is not None:
+            usage = dict(self.report_state.get_total_llm_usage())
+        subscription = False
+        with contextlib.suppress(Exception):
+            subscription = is_subscription_run(self.report_state)
+        model_warning = ""
+        if model and not is_recommended_or_frontier_model(model):
+            model_warning = (
+                f"{model} is not a recommended frontier model; pentest quality could be degraded"
+            )
+        state = {
+            "setup_mode": self.setup_mode,
+            "scan_started": self.scan_started,
+            "scan_state": self.scan_state,
+            "targets": [
+                terminal_projection(target, max_string=128) for target in self.targets[:16]
+            ],
+            "target_count": len(self.targets),
+            "working_dir": str(Path.cwd()),
+            "pending_mount": self.pending_workspace_mount or "",
+            "instruction": terminal_projection(self.instruction, max_string=2 * 1024),
+            "scan_mode": self.scan_mode,
+            "max_budget_usd": self.max_budget_usd,
+            "max_turns": self.max_turns,
+            "scope_mode": self.scope_mode,
+            "diff_base": terminal_projection(self.diff_base, max_string=256),
+            "model": terminal_projection(model, max_string=256),
+            "model_warning": terminal_projection(model_warning, max_string=512),
+            "caido_url": terminal_projection(
+                getattr(self.report_state, "caido_url", None), max_string=1024
+            ),
+            "messages": [
+                {
+                    "id": str(message.get("id", ""))[:64],
+                    "text": terminal_projection(message.get("text", ""), max_string=256),
+                    "level": str(message.get("level", "info"))[:32],
+                }
+                for message in self.messages[-10:]
+            ],
+            "usage": terminal_projection(usage, max_string=256, max_items=20),
+            "subscription": subscription,
+            "viewer_status": self.viewer_status,
+            "viewer_url": terminal_projection(self.viewer_url, max_string=1024),
+            "error": terminal_projection(self.error, max_string=2 * 1024),
+        }
+        return bounded_state_projection(state)
+
+    def collection(self, name: str) -> list[dict[str, Any]]:
+        """Return one bounded terminal projection with stable item identities."""
+        if name == "agents":
+            return [
+                {
+                    key: terminal_projection(agent.get(key), max_string=256, max_items=5)
+                    for key in (
+                        "id",
+                        "name",
+                        "parent_id",
+                        "status",
+                        "error_message",
+                        "created_at",
+                        "updated_at",
+                    )
+                    if key in agent
+                }
+                for agent in self.live_view.agents.values()
+            ]
+        if name == "events":
+            return [collection_item_projection(event) for event in self.live_view.events]
+        if name == "vulnerabilities":
+            reports = (
+                self.report_state.vulnerability_reports if self.report_state is not None else []
+            )[-MAX_TERMINAL_VULNERABILITIES:]
+            result: list[dict[str, Any]] = []
+            for index, report in enumerate(reports):
+                projected = collection_item_projection(report)
+                report_id = projected.get("id")
+                if not isinstance(report_id, str) or not report_id:
+                    projected["id"] = f"vulnerability-{index}"
+                result.append(projected)
+            return result
+        raise ValueError(f"Unknown collection: {name}")
+
+    def collection_snapshot(self, name: str) -> tuple[int | None, list[dict[str, Any]]]:
+        """Return a collection cursor and complete bounded projection."""
+        if name == "events":
+            cursor, events = self.live_view.event_snapshot(limit=MAX_TERMINAL_EVENTS)
+            return cursor, [collection_item_projection(event) for event in events]
+        return None, self.collection(name)
+
+    def collection_changes(
+        self,
+        name: str,
+        cursor: int,
+    ) -> tuple[int, list[dict[str, Any]]]:
+        """Return event upserts since a monotonic source cursor."""
+        if name != "events":
+            raise ValueError(f"Collection {name!r} does not expose incremental changes")
+        next_cursor, events = self.live_view.event_changes_since(cursor)
+        return next_cursor, [
+            collection_item_projection(event) for event in events[-MAX_TERMINAL_EVENTS:]
+        ]
+
+    async def handle(self, command: str, payload: dict[str, Any]) -> dict[str, Any]:
+        handlers = {
+            "setup.add_target": self._add_target,
+            "setup.set_instruction": self._set_instruction,
+            "setup.start": self._start,
+            "setup.confirm_mount": self._confirm_mount,
+            "agent.send_message": self._send_message,
+            "agent.stop": self._stop_agent,
+            "viewer.open": self._open_viewer,
+            "app.quit": self._quit,
+        }
+        handler = handlers.get(command)
+        if handler is None:
+            raise ValueError(f"Unknown command: {command}")
+        result = await handler(payload)
+        self.notify_changed()
+        return result
+
+    async def _add_target(self, payload: dict[str, Any]) -> dict[str, Any]:
+        self._require_setup_mutable()
+        target = self._required_string(payload, "target")
+        if target not in self.targets:
+            self.targets.append(target)
+        return {"target": target, "total": len(self.targets)}
+
+    async def _set_instruction(self, payload: dict[str, Any]) -> dict[str, Any]:
+        self._require_setup_mutable()
+        instruction = payload.get("instruction", "")
+        if not isinstance(instruction, str):
+            raise TypeError("instruction must be a string")
+        self.instruction = instruction.strip()
+        return {"instruction": self.instruction}
+
+    async def _start(self, payload: dict[str, Any]) -> dict[str, Any]:
+        if self.scan_started or self._start_in_progress:
+            raise RuntimeError("Scan is already starting or running")
+        # A bare prompt launches optimistically, like a coding agent: it skips
+        # the network model preflight and surfaces any model error live. A named
+        # target keeps the preflight so a real scan does not commit blind.
+        verify = payload.get("verify", True)
+        if not isinstance(verify, bool):
+            raise TypeError("verify must be a boolean")
+        # Launching with no target mounts the working directory, so it requires
+        # the user's explicit confirmation rather than happening silently.
+        mount_working_dir = payload.get("mount_working_dir", False)
+        if not isinstance(mount_working_dir, bool):
+            raise TypeError("mount_working_dir must be a boolean")
+        model = (load_settings().llm.model or "").strip()
+        if not model:
+            raise ValueError("No model configured. Set STRIX_LLM first.")
+        if self._on_start is None:
+            raise RuntimeError("Scan start is unavailable")
+        if not self.targets:
+            if not mount_working_dir:
+                raise ValueError("No target set. Add a target first.")
+            # Mounting the working directory needs the user's confirmation, and
+            # that is asked in the live view. Enter it now and prepare nothing
+            # until the answer arrives, so declining leaves no run behind.
+            self.pending_workspace_mount = str(Path.cwd())
+            self._pending_verify = verify
+            self.setup_mode = False
+            self.scan_started = True
+            self.scan_state = "preparing"
+            return {"started": True}
+        await self._begin_scan(verify)
+        return {"started": True}
+
+    async def _begin_scan(self, verify: bool) -> None:
+        if self._on_start is None:
+            raise RuntimeError("Scan start is unavailable")
+        self._start_in_progress = True
+        try:
+            await self._on_start(verify)
+        finally:
+            self._start_in_progress = False
+        self.setup_mode = False
+        self.scan_started = True
+        self.scan_state = "running"
+
+    async def _confirm_mount(self, payload: dict[str, Any]) -> dict[str, Any]:
+        """Answer the pending working-directory mount asked for in the live view."""
+        mount = self.pending_workspace_mount
+        if mount is None:
+            raise RuntimeError("No mount confirmation is pending")
+        approved = payload.get("approved")
+        if not isinstance(approved, bool):
+            raise TypeError("approved must be a boolean")
+        self.pending_workspace_mount = None
+        if not approved:
+            # Nothing was prepared, so return to the start screen untouched.
+            self.workspace_mount = None
+            self.enter_setup()
+            return {"approved": False}
+        self.workspace_mount = mount
+        await self._begin_scan(self._pending_verify)
+        return {"approved": True}
+
+    async def _send_message(self, payload: dict[str, Any]) -> dict[str, Any]:
+        agent_id = self._required_string(payload, "agent_id")
+        message = self._required_string(payload, "message")
+        if self.coordinator is None:
+            raise RuntimeError("Agent coordinator is unavailable")
+        if self.scan_loop is None or self.scan_loop.is_closed():
+            raise RuntimeError("Scan loop is not ready")
+        self.live_view.record_user_message(agent_id, message)
+        if self.scan_loop is asyncio.get_running_loop():
+            delivered = await self.coordinator.send(
+                agent_id,
+                {"from": "user", "content": message, "type": "instruction"},
+            )
+        else:
+            future = asyncio.run_coroutine_threadsafe(
+                self.coordinator.send(
+                    agent_id,
+                    {"from": "user", "content": message, "type": "instruction"},
+                ),
+                self.scan_loop,
+            )
+            delivered = await asyncio.wrap_future(future)
+        if not delivered:
+            raise RuntimeError("Message could not be delivered")
+        return {"sent": True}
+
+    async def _stop_agent(self, payload: dict[str, Any]) -> dict[str, Any]:
+        agent_id = self._required_string(payload, "agent_id")
+        agent = self.live_view.agents.get(agent_id)
+        if agent is None:
+            raise ValueError(f"Unknown agent: {agent_id}")
+        status = str(agent.get("status", ""))
+        if status not in _STOPPABLE_AGENT_STATUSES:
+            raise RuntimeError(f"Agent '{agent_id}' cannot be stopped while {status or 'unknown'}")
+        if self.coordinator is None or self.scan_loop is None or self.scan_loop.is_closed():
+            raise RuntimeError("Scan loop is not ready")
+        if self.scan_loop is asyncio.get_running_loop():
+            accepted = await self.coordinator.cancel_descendants_graceful(agent_id)
+        else:
+            future = asyncio.run_coroutine_threadsafe(
+                self.coordinator.cancel_descendants_graceful(agent_id), self.scan_loop
+            )
+            accepted = await asyncio.wrap_future(future)
+        if not accepted:
+            raise RuntimeError(f"Agent '{agent_id}' is no longer active")
+        return {"stopped": True}
+
+    async def _open_viewer(self, _payload: dict[str, Any]) -> dict[str, Any]:
+        if self.viewer_url:
+            with contextlib.suppress(Exception):
+                webbrowser.open(self.viewer_url)
+            return {"status": "running", "url": self.viewer_url}
+        if self.report_state is None:
+            self.viewer_status = "failed"
+            return {"status": self.viewer_status, "error": "Scan output is not ready"}
+        try:
+            from strix.interface.tui.backend.messages import (
+                send_user_message_to_agent,
+            )
+            from strix.interface.viewer.server import (
+                authorized_url,
+                bundle_is_built,
+                serve,
+            )
+
+            if not bundle_is_built():
+                self.viewer_status = "unavailable"
+                return {"status": self.viewer_status, "error": "Viewer UI not built"}
+
+            def steer(agent_id: str, message: str) -> bool:
+                return send_user_message_to_agent(
+                    coordinator=self.coordinator,
+                    loop=self.scan_loop,
+                    live_view=self.live_view,
+                    target_agent_id=agent_id,
+                    message=message,
+                    notify_changed=self.notify_changed,
+                    wait_for_delivery=True,
+                )
+
+            httpd, url, token = serve(
+                self.report_state.get_run_dir(),
+                open_browser=True,
+                steer_handler=steer,
+            )
+            self._viewer_httpd = httpd
+            self.viewer_url = authorized_url(url, token)
+            self.viewer_status = "running"
+            with contextlib.suppress(Exception):
+                from strix.telemetry import posthog
+
+                live = self.report_state.run_record.get("status") not in {
+                    "completed",
+                    "stopped",
+                    "failed",
+                    "interrupted",
+                }
+                posthog.viewer_opened(source="tui", live=live)
+        except Exception:  # noqa: BLE001 - viewer startup failures must not crash the TUI
+            self.viewer_status = "failed"
+            return {"status": self.viewer_status, "error": "Viewer failed to start"}
+        else:
+            return {"status": self.viewer_status, "url": self.viewer_url}
+
+    def close_viewer(self) -> None:
+        httpd = self._viewer_httpd
+        if httpd is None:
+            return
+        self._viewer_httpd = None
+        with contextlib.suppress(Exception):
+            httpd.shutdown()
+            httpd.server_close()
+
+    async def _quit(self, _payload: dict[str, Any]) -> dict[str, Any]:
+        self.close_viewer()
+        if self._on_quit is not None:
+            await self._on_quit()
+        self.scan_state = "stopped"
+        return {"quitting": True}
+
+    @staticmethod
+    def _required_string(payload: dict[str, Any], name: str) -> str:
+        value = payload.get(name)
+        if not isinstance(value, str) or not value.strip():
+            raise ValueError(f"{name} must be a non-empty string")
+        return value.strip()
+
+    def _require_setup_mutable(self) -> None:
+        if not self.setup_mode or self.scan_started or self._start_in_progress:
+            raise RuntimeError("Setup can no longer be changed after the scan starts")
@@ -0,0 +1,136 @@
+"""Go-TUI event projection layered on the shared base projection."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Any
+
+from strix.interface.tui.live_view import TuiLiveView as BaseLiveView
+
+
+_MAX_LIVE_EVENTS = 10_000
+
+
+class TuiLiveView(BaseLiveView):
+    """Add protocol cursors and bounds on top of the shared projection state."""
+
+    def __init__(self) -> None:
+        super().__init__()
+        self._event_cursor = 0
+        self._event_change_cursor: dict[str, int] = {}
+        self._events_by_id: dict[str, dict[str, Any]] = {}
+
+    def upsert_agent(  # type: ignore[override]
+        self,
+        agent_id: str,
+        *,
+        name: str | None = None,
+        parent_id: str | None = None,
+        status: str | None = None,
+        error_message: str | None = None,
+    ) -> bool:
+        now = datetime.now(UTC).isoformat()
+        current = self.agents.get(agent_id)
+        if current is None:
+            current = {
+                "id": agent_id,
+                "name": name or agent_id,
+                "parent_id": parent_id,
+                "status": status or "running",
+                "created_at": now,
+                "updated_at": now,
+            }
+            if error_message:
+                current["error_message"] = error_message
+            self.agents[agent_id] = current
+            return True
+
+        changed = False
+        if name is not None and current.get("name") != name:
+            current["name"] = name
+            changed = True
+        if (parent_id is not None or "parent_id" not in current) and current.get(
+            "parent_id"
+        ) != parent_id:
+            current["parent_id"] = parent_id
+            changed = True
+        if status is not None and current.get("status") != status:
+            current["status"] = status
+            changed = True
+        if error_message and current.get("error_message") != error_message:
+            current["error_message"] = error_message
+            changed = True
+        if changed:
+            current["updated_at"] = now
+        return changed
+
+    def _append_event(
+        self,
+        agent_id: str,
+        event_type: str,
+        data: dict[str, Any],
+        *,
+        timestamp: str | None = None,
+    ) -> dict[str, Any]:
+        event = super()._append_event(
+            agent_id,
+            event_type,
+            data,
+            timestamp=timestamp,
+        )
+        self._events_by_id[event["id"]] = event
+        self._mark_event_changed(event)
+        if len(self.events) > _MAX_LIVE_EVENTS:
+            removed = self.events.pop(0)
+            removed_id = str(removed.get("id", ""))
+            self._events_by_id.pop(removed_id, None)
+            self._event_change_cursor.pop(removed_id, None)
+            self._open_assistant_event_by_agent = {
+                current_agent_id: current
+                for current_agent_id, current in self._open_assistant_event_by_agent.items()
+                if current is not removed
+            }
+            self._tool_event_by_agent_and_call_id = {
+                key: current
+                for key, current in self._tool_event_by_agent_and_call_id.items()
+                if current is not removed
+            }
+        return event
+
+    def _bump_event(  # type: ignore[override]
+        self,
+        event: dict[str, Any],
+        *,
+        timestamp: str | None = None,
+    ) -> None:
+        event["version"] = int(event.get("version", 0)) + 1
+        event["timestamp"] = timestamp or datetime.now(UTC).isoformat()
+        self._mark_event_changed(event)
+
+    def _mark_event_changed(self, event: dict[str, Any]) -> None:
+        event_id = event.get("id")
+        if not isinstance(event_id, str) or not event_id:
+            return
+        self._event_cursor += 1
+        self._event_change_cursor[event_id] = self._event_cursor
+
+    def event_snapshot(self, *, limit: int | None = None) -> tuple[int, list[dict[str, Any]]]:
+        events = self.events[-limit:] if limit is not None else self.events
+        return self._event_cursor, list(events)
+
+    def event_changes_since(self, cursor: int) -> tuple[int, list[dict[str, Any]]]:
+        if cursor < 0 or cursor > self._event_cursor:
+            raise ValueError("event cursor is outside the available history")
+        changed_ids = sorted(
+            (
+                (change_cursor, event_id)
+                for event_id, change_cursor in self._event_change_cursor.items()
+                if change_cursor > cursor
+            )
+        )
+        changed = [
+            self._events_by_id[event_id]
+            for _change_cursor, event_id in changed_ids
+            if event_id in self._events_by_id
+        ]
+        return self._event_cursor, changed
@@ -0,0 +1,61 @@
+"""Confirmed message delivery for non-Textual interactive clients."""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import TYPE_CHECKING, Any
+
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+
+logger = logging.getLogger(__name__)
+
+
+def send_user_message_to_agent(
+    *,
+    coordinator: Any,
+    loop: asyncio.AbstractEventLoop | None,
+    live_view: Any,
+    target_agent_id: str,
+    message: str,
+    notify_changed: Callable[[], None] | None = None,
+    wait_for_delivery: bool = False,
+) -> bool:
+    if loop is None or loop.is_closed():
+        return False
+
+    async def deliver() -> bool:
+        delivered = bool(
+            await coordinator.send(
+                target_agent_id,
+                {"from": "user", "content": message, "type": "instruction"},
+            )
+        )
+        if delivered:
+            live_view.record_user_message(target_agent_id, message)
+            if notify_changed is not None:
+                notify_changed()
+        return delivered
+
+    future = asyncio.run_coroutine_threadsafe(deliver(), loop)
+    if wait_for_delivery:
+        try:
+            return bool(future.result(timeout=10))
+        except Exception:
+            logger.exception("TUI user message delivery failed")
+            return False
+    future.add_done_callback(_log_delivery_failure)
+    return True
+
+
+def _log_delivery_failure(future: Any) -> None:
+    try:
+        delivered = bool(future.result())
+    except Exception:
+        logger.exception("TUI user message delivery failed")
+        return
+    if not delivered:
+        logger.warning("TUI user message was not persisted to the SDK session")
@@ -0,0 +1,182 @@
+"""Wire-safe projections of runtime state for the TUI backend."""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+
+SCAN_MODES = ("quick", "standard", "deep")
+SCOPE_MODES = ("auto", "diff", "full")
+MAX_PROJECTION_STRING = 64 * 1024
+MAX_IMAGE_DATA_URI_BYTES = 2 * 1024 * 1024
+MAX_COLLECTION_ITEM_BYTES = 512 * 1024
+MAX_TERMINAL_EVENTS = 5_000
+MAX_TERMINAL_VULNERABILITIES = 1_000
+STATE_TARGET_BYTES = 48 * 1024
+TERMINAL_ESCAPE_RE = re.compile(r"\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_][0-?]*[ -/]*[@-~]")
+
+
+def sanitize_terminal_text(value: str) -> str:
+    without_escapes = TERMINAL_ESCAPE_RE.sub("", value)
+    return "".join(
+        character
+        for character in without_escapes
+        if character in "\n\t" or (ord(character) >= 32 and not 127 <= ord(character) <= 159)
+    )
+
+
+def terminal_projection(  # noqa: PLR0911
+    value: Any,
+    *,
+    max_string: int = MAX_PROJECTION_STRING,
+    max_items: int = 200,
+    depth: int = 0,
+) -> Any:
+    """Copy and bound terminal-only data without changing durable history."""
+    if isinstance(value, str):
+        if value.startswith("data:image/"):
+            if len(value) <= MAX_IMAGE_DATA_URI_BYTES:
+                return value
+            return "[image omitted from terminal projection]"
+        clean = sanitize_terminal_text(value)
+        if len(clean) <= max_string:
+            return clean
+        omitted = len(clean) - max_string
+        return f"{clean[:max_string]}\n...[{omitted} characters omitted from terminal projection]"
+    if value is None or isinstance(value, bool | int | float):
+        return value
+    if depth >= 8:
+        return "[nested value omitted from terminal projection]"
+    if isinstance(value, dict):
+        items = list(value.items())
+        projected = {
+            sanitize_terminal_text(str(key)): terminal_projection(
+                item,
+                max_string=max_string,
+                max_items=max_items,
+                depth=depth + 1,
+            )
+            for key, item in items[:max_items]
+        }
+        if len(items) > max_items:
+            projected["_projection_notice"] = (
+                f"{len(items) - max_items} fields omitted from terminal projection"
+            )
+        return projected
+    if isinstance(value, list | tuple):
+        projected_items = [
+            terminal_projection(
+                item,
+                max_string=max_string,
+                max_items=max_items,
+                depth=depth + 1,
+            )
+            for item in value[:max_items]
+        ]
+        if len(value) > max_items:
+            projected_items.append(
+                f"[{len(value) - max_items} items omitted from terminal projection]"
+            )
+        return projected_items
+    return terminal_projection(
+        str(value),
+        max_string=max_string,
+        max_items=max_items,
+        depth=depth,
+    )
+
+
+def collection_item_projection(item: dict[str, Any]) -> dict[str, Any]:
+    # Image data URIs are exempt from string truncation, so grant them their
+    # own byte budget on top of the regular per-item budget.
+    item_budget = MAX_COLLECTION_ITEM_BYTES + MAX_IMAGE_DATA_URI_BYTES
+    projected = terminal_projection(item)
+    assert isinstance(projected, dict)
+    if len(json.dumps(projected, default=str, separators=(",", ":")).encode()) <= item_budget:
+        return projected
+
+    projected = terminal_projection(item, max_string=8 * 1024, max_items=40)
+    assert isinstance(projected, dict)
+    projected["projection_truncated"] = True
+    if len(json.dumps(projected, default=str, separators=(",", ":")).encode()) <= item_budget:
+        return projected
+
+    # Preserve identity and useful summary fields even for pathological nested
+    # tool output or finding evidence.
+    compact: dict[str, Any] = {
+        key: terminal_projection(item[key], max_string=8 * 1024, max_items=10)
+        for key in (
+            "id",
+            "version",
+            "type",
+            "agent_id",
+            "timestamp",
+            "title",
+            "severity",
+            "description",
+        )
+        if key in item
+    }
+    compact["projection_truncated"] = True
+    return compact
+
+
+def bounded_state_projection(state: dict[str, Any]) -> dict[str, Any]:
+    """Keep mutable control state comfortably below the 64 KiB frame limit."""
+
+    def encoded_size(value: dict[str, Any]) -> int:
+        return len(
+            json.dumps(value, default=str, ensure_ascii=False, separators=(",", ":")).encode()
+        )
+
+    if encoded_size(state) <= STATE_TARGET_BYTES:
+        return state
+
+    state["projection_truncated"] = True
+    state["targets"] = [
+        terminal_projection(target, max_string=64) for target in state["targets"][:8]
+    ]
+    state["instruction"] = terminal_projection(state["instruction"], max_string=512)
+    state["messages"] = [
+        {
+            **message,
+            "text": terminal_projection(message.get("text", ""), max_string=128),
+        }
+        for message in state["messages"][-5:]
+    ]
+    state["usage"] = {}
+    state["error"] = terminal_projection(state["error"], max_string=512)
+    state["model_warning"] = terminal_projection(state["model_warning"], max_string=256)
+    state["caido_url"] = terminal_projection(state["caido_url"], max_string=256)
+    state["viewer_url"] = terminal_projection(state["viewer_url"], max_string=256)
+    if encoded_size(state) <= STATE_TARGET_BYTES:
+        return state
+
+    # Defensive final projection: use an explicit schema so future snapshot
+    # fields cannot silently bypass the aggregate byte budget.
+    return {
+        "setup_mode": state["setup_mode"],
+        "scan_started": state["scan_started"],
+        "scan_state": state["scan_state"],
+        "targets": state["targets"][:4],
+        "target_count": state["target_count"],
+        "instruction": terminal_projection(state["instruction"], max_string=128),
+        "scan_mode": state["scan_mode"],
+        "max_budget_usd": state["max_budget_usd"],
+        "max_turns": state["max_turns"],
+        "scope_mode": state["scope_mode"],
+        "diff_base": state["diff_base"],
+        "provider": state["provider"],
+        "model": state["model"],
+        "model_warning": "",
+        "caido_url": None,
+        "messages": [],
+        "usage": {},
+        "subscription": state["subscription"],
+        "viewer_status": state["viewer_status"],
+        "viewer_url": None,
+        "error": terminal_projection(state["error"], max_string=256),
+        "projection_truncated": True,
+    }
@@ -0,0 +1,40 @@
+"""Versioned JSON protocol shared with the Go TUI."""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+PROTOCOL_VERSION = 3
+PROTOCOL_CAPABILITIES = (
+    "state-revisions",
+    "collection-deltas",
+    "structured-command-errors",
+    "agents-collection",
+)
+
+# Commands and control messages are intentionally small. Event and finding
+# history uses a separate bounded collection stream so a resumed run can be
+# larger than any individual frame.
+MAX_COMMAND_BYTES = 64 * 1024
+MAX_COLLECTION_FRAME_BYTES = 4 * 1024 * 1024
+
+
+class ProtocolHandshakeError(RuntimeError):
+    """Raised before the Go TUI is activated when v3 negotiation fails."""
+
+
+def envelope(
+    message_type: str,
+    payload: dict[str, Any],
+    *,
+    request_id: str | None = None,
+) -> dict[str, Any]:
+    message: dict[str, Any] = {
+        "version": PROTOCOL_VERSION,
+        "type": message_type,
+        "payload": payload,
+    }
+    if request_id:
+        message["request_id"] = request_id
+    return message
@@ -0,0 +1,531 @@
+"""Private framed IPC connection used by the Go TUI."""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+import logging
+import struct
+from collections import deque
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any
+
+from strix.interface.tui.backend.projection import sanitize_terminal_text
+from strix.interface.tui.backend.protocol import (
+    MAX_COLLECTION_FRAME_BYTES,
+    MAX_COMMAND_BYTES,
+    PROTOCOL_CAPABILITIES,
+    PROTOCOL_VERSION,
+    ProtocolHandshakeError,
+    envelope,
+)
+
+
+if TYPE_CHECKING:
+    import socket
+
+    from strix.interface.tui.backend.controller import TuiController
+
+logger = logging.getLogger(__name__)
+
+_HEADER = struct.Struct(">I")
+_HANDSHAKE_TIMEOUT = 10.0
+_COLLECTIONS = ("agents", "events", "vulnerabilities")
+_COLLECTION_ITEM_LIMITS = {"events": 5_000, "vulnerabilities": 1_000}
+# Leave enough room for the collection envelope and cursor metadata.
+_COLLECTION_PAYLOAD_TARGET = MAX_COLLECTION_FRAME_BYTES - 16 * 1024
+
+
+class _MessageTooLargeError(ValueError):
+    pass
+
+
+@dataclass
+class _CollectionState:
+    revision: int = 0
+    bootstrapped: bool = False
+    order: list[str] = field(default_factory=list)
+    items: dict[str, dict[str, Any]] = field(default_factory=dict)
+    fingerprints: dict[str, str] = field(default_factory=dict)
+    source_cursor: int | None = None
+
+
+class TuiBackendServer:
+    """Serve one TUI child over an authenticated, connected socket."""
+
+    def __init__(self, controller: TuiController) -> None:
+        self.controller = controller
+        self._socket: socket.socket | None = None
+        self._reader_task: asyncio.Task[None] | None = None
+        self._broadcast_event = asyncio.Event()
+        self._broadcast_task: asyncio.Task[None] | None = None
+        self._write_lock = asyncio.Lock()
+        self._sync_lock = asyncio.Lock()
+        self._state_revision = 0
+        self._state_fingerprint = ""
+        self._collections = {name: _CollectionState() for name in _COLLECTIONS}
+        self._seen_request_ids: set[str] = set()
+        self._request_id_order: deque[str] = deque()
+        self.activated = False
+        controller.set_change_callback(self.notify_changed)
+
+    async def start(self, connection: socket.socket) -> None:
+        """Negotiate protocol v3 before activating command or state traffic."""
+        if self._socket is not None:
+            raise RuntimeError("TUI backend is already started")
+        connection.setblocking(False)  # noqa: FBT003
+        self._socket = connection
+        try:
+            await self._send(envelope("hello", {"capabilities": list(PROTOCOL_CAPABILITIES)}))
+            await asyncio.wait_for(self._receive_ready(), timeout=_HANDSHAKE_TIMEOUT)
+        except TimeoutError as exc:
+            raise ProtocolHandshakeError("Timed out waiting for TUI protocol ready") from exc
+        except (EOFError, ConnectionError, OSError) as exc:
+            raise ProtocolHandshakeError(f"TUI closed during protocol handshake: {exc}") from exc
+        except (TypeError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
+            raise ProtocolHandshakeError(str(exc)) from exc
+
+        self.activated = True
+        self._reader_task = asyncio.create_task(self._read_loop())
+        self._broadcast_task = asyncio.create_task(self._broadcast_loop())
+        self.notify_changed()
+
+    async def close(self) -> None:
+        tasks = [task for task in (self._reader_task, self._broadcast_task) if task is not None]
+        for task in tasks:
+            task.cancel()
+        for task in tasks:
+            if task is asyncio.current_task():
+                continue
+            with contextlib.suppress(asyncio.CancelledError):
+                await task
+        self._reader_task = None
+        self._broadcast_task = None
+        self._close_socket()
+
+    def _close_socket(self) -> None:
+        if self._socket is not None:
+            self._socket.close()
+            self._socket = None
+
+    def notify_changed(self) -> None:
+        if self.activated:
+            self._broadcast_event.set()
+
+    async def _read_exactly(self, size: int) -> bytes:
+        connection = self._socket
+        if connection is None:
+            raise ConnectionError("TUI IPC connection is closed")
+        loop = asyncio.get_running_loop()
+        chunks: list[bytes] = []
+        remaining = size
+        while remaining:
+            chunk = await loop.sock_recv(connection, remaining)
+            if not chunk:
+                raise EOFError("TUI IPC peer closed")
+            chunks.append(chunk)
+            remaining -= len(chunk)
+        return b"".join(chunks)
+
+    async def _read_frame(self, maximum: int) -> bytes:
+        (size,) = _HEADER.unpack(await self._read_exactly(_HEADER.size))
+        if size == 0 or size > maximum:
+            # Reject the length before allocating or reading its payload.
+            raise ConnectionError(f"invalid TUI IPC frame size: {size}")
+        return await self._read_exactly(size)
+
+    async def _receive_ready(self) -> None:
+        raw = await self._read_frame(MAX_COMMAND_BYTES)
+        message = json.loads(raw.decode("utf-8"))
+        if not isinstance(message, dict):
+            raise TypeError("TUI ready message must be an object")
+        if message.get("version") != PROTOCOL_VERSION:
+            raise ValueError(
+                f"TUI protocol mismatch: expected v{PROTOCOL_VERSION}, "
+                f"received v{message.get('version')}"
+            )
+        if message.get("type") != "ready":
+            raise ValueError("TUI protocol handshake expected ready")
+        payload = message.get("payload")
+        if not isinstance(payload, dict):
+            raise TypeError("TUI ready payload must be an object")
+        capabilities = payload.get("capabilities")
+        if capabilities != list(PROTOCOL_CAPABILITIES):
+            raise ValueError("TUI protocol capability mismatch")
+
+    async def _read_loop(self) -> None:
+        try:
+            while True:
+                raw = await self._read_frame(MAX_COMMAND_BYTES)
+                response, resync = await self._handle_message(raw)
+                if response is not None:
+                    await self._send_command_response(response)
+                if resync is not None:
+                    await self._resync_collection(resync)
+        except asyncio.CancelledError:
+            raise
+        except (EOFError, ConnectionError, OSError):
+            self._close_socket()
+
+    @staticmethod
+    def _decode_message(raw: bytes) -> tuple[str, str, dict[str, object]]:
+        message = json.loads(raw.decode("utf-8"))
+        if not isinstance(message, dict):
+            raise TypeError("message must be an object")
+        request_id = message.get("request_id")
+        if not isinstance(request_id, str) or not request_id:
+            raise ValueError("command request_id must be a non-empty string")
+        if message.get("version") != PROTOCOL_VERSION:
+            raise ValueError(f"unsupported protocol version; expected {PROTOCOL_VERSION}")
+        command = message.get("type")
+        payload = message.get("payload", {})
+        if not isinstance(command, str) or not isinstance(payload, dict):
+            raise TypeError("invalid command envelope")
+        if len(command) > 128:
+            raise ValueError("command name exceeds 128 characters")
+        return request_id, command, payload
+
+    @staticmethod
+    def _structured_error(exc: Exception) -> dict[str, object]:
+        if isinstance(exc, OSError):
+            return {"code": "persistence_error", "message": str(exc), "retryable": True}
+        if isinstance(exc, TypeError | ValueError | json.JSONDecodeError | UnicodeDecodeError):
+            return {"code": "invalid_request", "message": str(exc), "retryable": False}
+        if isinstance(exc, RuntimeError):
+            return {"code": "command_failed", "message": str(exc), "retryable": False}
+        logger.exception("Unhandled TUI command error", exc_info=exc)
+        return {
+            "code": "internal_error",
+            "message": "The command failed unexpectedly",
+            "retryable": True,
+        }
+
+    async def _handle_message(self, raw: bytes) -> tuple[dict[str, Any] | None, str | None]:
+        request_id: str | None = None
+        command = ""
+        resync: str | None = None
+        try:
+            preliminary = json.loads(raw.decode("utf-8"))
+            if isinstance(preliminary, dict):
+                raw_request_id = preliminary.get("request_id")
+                if isinstance(raw_request_id, str) and raw_request_id:
+                    request_id = raw_request_id
+                raw_command = preliminary.get("type")
+                if isinstance(raw_command, str):
+                    command = raw_command[:128]
+            request_id, command, payload = self._decode_message(raw)
+            if request_id in self._seen_request_ids:
+                raise ValueError(f"duplicate request_id: {request_id}")  # noqa: TRY301
+            self._seen_request_ids.add(request_id)
+            self._request_id_order.append(request_id)
+            if len(self._request_id_order) > 10_000:
+                self._seen_request_ids.discard(self._request_id_order.popleft())
+            if command == "collection.resync":
+                collection = payload.get("collection")
+                if not isinstance(collection, str) or collection not in _COLLECTIONS:
+                    choices = ", ".join(_COLLECTIONS)
+                    raise ValueError(f"collection must be one of: {choices}")  # noqa: TRY301
+                result: dict[str, Any] = {"collection": collection, "resyncing": True}
+                resync = collection
+            else:
+                result = await self.controller.handle(command, payload)
+            response = envelope(
+                "command_result",
+                {"ok": True, "command": command, "result": result},
+                request_id=request_id,
+            )
+        except Exception as exc:  # noqa: BLE001 - command failures are protocol results
+            if request_id is None:
+                # A malformed envelope without an ID cannot be correlated. Keep
+                # the reader alive and wait for the next valid command.
+                logger.warning("Ignoring uncorrelatable TUI command: %s", exc)
+                return None, None
+            response = envelope(
+                "command_result",
+                {
+                    "ok": False,
+                    "command": command,
+                    "error": self._structured_error(exc),
+                },
+                request_id=request_id,
+            )
+        return response, resync
+
+    def _encode(self, message: dict[str, Any]) -> bytes:
+        raw = json.dumps(
+            self._sanitize_wire_value(message),
+            default=str,
+            ensure_ascii=False,
+            separators=(",", ":"),
+        ).encode("utf-8")
+        maximum = (
+            MAX_COLLECTION_FRAME_BYTES
+            if message.get("type") in {"collection_bootstrap", "collection_delta"}
+            else MAX_COMMAND_BYTES
+        )
+        if len(raw) > maximum:
+            raise _MessageTooLargeError(f"TUI IPC message exceeds {maximum} bytes")
+        return raw
+
+    @classmethod
+    def _sanitize_wire_value(cls, value: Any) -> Any:
+        if isinstance(value, str):
+            return sanitize_terminal_text(value)
+        if isinstance(value, dict):
+            return {
+                sanitize_terminal_text(str(key)): cls._sanitize_wire_value(item)
+                for key, item in value.items()
+            }
+        if isinstance(value, list):
+            return [cls._sanitize_wire_value(item) for item in value]
+        if isinstance(value, tuple):
+            return [cls._sanitize_wire_value(item) for item in value]
+        return value
+
+    async def _send(self, message: dict[str, Any]) -> None:
+        connection = self._socket
+        if connection is None:
+            raise ConnectionError("TUI IPC connection is closed")
+        raw = self._encode(message)
+        framed = _HEADER.pack(len(raw)) + raw
+        async with self._write_lock:
+            await asyncio.get_running_loop().sock_sendall(connection, framed)
+
+    async def _send_command_response(self, response: dict[str, Any]) -> None:
+        try:
+            await self._send(response)
+        except _MessageTooLargeError:
+            request_id = response.get("request_id")
+            payload = response.get("payload")
+            command = payload.get("command", "") if isinstance(payload, dict) else ""
+            await self._send(
+                envelope(
+                    "command_result",
+                    {
+                        "ok": False,
+                        "command": command,
+                        "error": {
+                            "code": "result_too_large",
+                            "message": "Command result exceeds the terminal frame limit",
+                            "retryable": False,
+                        },
+                    },
+                    request_id=request_id if isinstance(request_id, str) else None,
+                )
+            )
+
+    @staticmethod
+    def _fingerprint(value: Any) -> str:
+        return json.dumps(value, default=str, sort_keys=True, separators=(",", ":"))
+
+    async def _send_state_if_changed(self) -> None:
+        state = self.controller.snapshot()
+        fingerprint = self._fingerprint(state)
+        if fingerprint == self._state_fingerprint:
+            return
+        revision = self._state_revision + 1
+        await self._send(envelope("state", {"revision": revision, "state": state}))
+        self._state_revision = revision
+        self._state_fingerprint = fingerprint
+
+    @staticmethod
+    def _collection_values(
+        items: list[dict[str, Any]],
+    ) -> tuple[list[str], dict[str, dict[str, Any]], dict[str, str]]:
+        order: list[str] = []
+        by_id: dict[str, dict[str, Any]] = {}
+        fingerprints: dict[str, str] = {}
+        for item in items:
+            item_id = item.get("id")
+            if not isinstance(item_id, str) or not item_id:
+                continue
+            order.append(item_id)
+            by_id[item_id] = item
+            fingerprints[item_id] = TuiBackendServer._fingerprint(item)
+        return order, by_id, fingerprints
+
+    async def _send_collection_frames(
+        self,
+        message_type: str,
+        fixed: dict[str, Any],
+        field_name: str,
+        values: list[dict[str, Any]],
+    ) -> None:
+        cursor = 0
+        if not values:
+            payload = {**fixed, "cursor": 0, "next_cursor": 0, "done": True, field_name: []}
+            await self._send(envelope(message_type, payload))
+            return
+
+        while cursor < len(values):
+            chunk: list[dict[str, Any]] = []
+            next_cursor = cursor
+            empty_payload = {
+                **fixed,
+                "cursor": cursor,
+                "next_cursor": cursor,
+                "done": False,
+                field_name: [],
+            }
+            estimated_size = len(
+                json.dumps(
+                    envelope(message_type, empty_payload),
+                    default=str,
+                    separators=(",", ":"),
+                ).encode("utf-8")
+            )
+            while next_cursor < len(values):
+                item = values[next_cursor]
+                item_size = len(
+                    json.dumps(item, default=str, separators=(",", ":")).encode("utf-8")
+                )
+                if estimated_size + item_size + 1 > _COLLECTION_PAYLOAD_TARGET and chunk:
+                    break
+                chunk.append(item)
+                estimated_size += item_size + 1
+                next_cursor += 1
+            payload = {
+                **fixed,
+                "cursor": cursor,
+                "next_cursor": next_cursor,
+                "done": next_cursor == len(values),
+                field_name: chunk,
+            }
+            await self._send(envelope(message_type, payload))
+            cursor = next_cursor
+
+    async def _send_collection_bootstrap(
+        self,
+        name: str,
+        items: list[dict[str, Any]] | None = None,
+    ) -> None:
+        state = self._collections[name]
+        source_cursor: int | None = None
+        if items is None:
+            source_cursor, projected = self.controller.collection_snapshot(name)
+        else:
+            projected = items
+        order, by_id, fingerprints = self._collection_values(projected)
+        revision = state.revision + 1
+        await self._send_collection_frames(
+            "collection_bootstrap",
+            {"collection": name, "revision": revision},
+            "items",
+            [by_id[item_id] for item_id in order],
+        )
+        state.revision = revision
+        state.bootstrapped = True
+        state.order = order
+        state.items = by_id
+        state.fingerprints = fingerprints
+        state.source_cursor = source_cursor
+
+    async def _send_collection_if_changed(self, name: str) -> None:
+        state = self._collections[name]
+        if name == "events" and state.bootstrapped and state.source_cursor is not None:
+            next_cursor, changed = self.controller.collection_changes(
+                name,
+                state.source_cursor,
+            )
+            if next_cursor == state.source_cursor:
+                return
+            operations: list[dict[str, Any]] = []
+            for item in changed:
+                item_id = item.get("id")
+                if not isinstance(item_id, str) or not item_id:
+                    continue
+                operations.append({"op": "upsert", "item": item})
+                if item_id not in state.items:
+                    state.order.append(item_id)
+                state.items[item_id] = item
+                state.fingerprints[item_id] = self._fingerprint(item)
+            limit = _COLLECTION_ITEM_LIMITS[name]
+            while len(state.order) > limit:
+                removed_id = state.order.pop(0)
+                state.items.pop(removed_id, None)
+                state.fingerprints.pop(removed_id, None)
+                operations.append({"op": "delete", "id": removed_id})
+            if operations:
+                revision = state.revision + 1
+                await self._send_collection_frames(
+                    "collection_delta",
+                    {
+                        "collection": name,
+                        "base_revision": state.revision,
+                        "revision": revision,
+                    },
+                    "operations",
+                    operations,
+                )
+                state.revision = revision
+            state.source_cursor = next_cursor
+            return
+        projected = self.controller.collection(name)
+        order, by_id, fingerprints = self._collection_values(projected)
+        if not state.bootstrapped:
+            await self._send_collection_bootstrap(
+                name,
+                None if name == "events" else projected,
+            )
+            return
+        if order == state.order and fingerprints == state.fingerprints:
+            return
+
+        retained = [item_id for item_id in state.order if item_id in by_id]
+        expected_order = retained + [item_id for item_id in order if item_id not in state.items]
+        if order != expected_order:
+            await self._send_collection_bootstrap(name, projected)
+            return
+
+        operations = [
+            {"op": "delete", "id": item_id} for item_id in state.order if item_id not in by_id
+        ] + [
+            {"op": "upsert", "item": by_id[item_id]}
+            for item_id in order
+            if fingerprints[item_id] != state.fingerprints.get(item_id)
+        ]
+        if not operations:
+            await self._send_collection_bootstrap(name, projected)
+            return
+
+        revision = state.revision + 1
+        await self._send_collection_frames(
+            "collection_delta",
+            {
+                "collection": name,
+                "base_revision": state.revision,
+                "revision": revision,
+            },
+            "operations",
+            operations,
+        )
+        state.revision = revision
+        state.order = order
+        state.items = by_id
+        state.fingerprints = fingerprints
+
+    async def _flush_updates(self) -> None:
+        async with self._sync_lock:
+            await self._send_state_if_changed()
+            for name in _COLLECTIONS:
+                await self._send_collection_if_changed(name)
+
+    async def _resync_collection(self, name: str) -> None:
+        async with self._sync_lock:
+            await self._send_collection_bootstrap(name)
+
+    async def _broadcast_loop(self) -> None:
+        try:
+            while True:
+                await self._broadcast_event.wait()
+                self._broadcast_event.clear()
+                await asyncio.sleep(0.05)
+                await self._flush_updates()
+        except asyncio.CancelledError:
+            raise
+        except (_MessageTooLargeError, ValueError):
+            logger.exception("TUI projection could not be framed")
+            self._close_socket()
+        except (ConnectionError, OSError):
+            self._close_socket()
@@ -0,0 +1,35 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/usestrix/strix/tui/internal/app"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+func main() {
+	app.SetVersion(os.Getenv("STRIX_VERSION"))
+	render.DetectKittyGraphics()
+	client, err := app.ConnectFromEnvironment()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "connect to Strix backend:", err)
+		os.Exit(1)
+	}
+	defer client.Close()
+	if err := client.Handshake(); err != nil {
+		fmt.Fprintln(os.Stderr, "negotiate Strix TUI protocol:", err)
+		os.Exit(1)
+	}
+	program := tea.NewProgram(app.New(client), tea.WithAltScreen(), tea.WithMouseCellMotion())
+	finalModel, err := program.Run()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "run TUI:", err)
+		os.Exit(1)
+	}
+	if model, ok := finalModel.(interface{ FatalError() error }); ok && model.FatalError() != nil {
+		fmt.Fprintln(os.Stderr, "run TUI:", model.FatalError())
+		os.Exit(1)
+	}
+}
@@ -0,0 +1,32 @@
+module github.com/usestrix/strix/tui
+
+go 1.24.0
+
+require (
+	github.com/alecthomas/chroma/v2 v2.14.0
+	github.com/atotto/clipboard v0.1.4
+	github.com/charmbracelet/bubbles v0.21.0
+	github.com/charmbracelet/bubbletea v1.3.10
+	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/x/ansi v0.10.1
+	github.com/charmbracelet/x/term v0.2.1
+	github.com/muesli/termenv v0.16.0
+	golang.org/x/sys v0.36.0
+)
+
+require (
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	golang.org/x/text v0.3.8 // indirect
+)
@@ -0,0 +1,61 @@
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
+github.com/alecthomas/assert/v2 v2.7.0 h1:QtqSACNS3tF7oasA8CU6A6sXZSBDqnm7RfpLl9bZqbE=
+github.com/alecthomas/assert/v2 v2.7.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.14.0 h1:R3+wzpnUArGcQz7fCETQBzO5n9IMNi13iIs46aU4V9E=
+github.com/alecthomas/chroma/v2 v2.14.0/go.mod h1:QolEbTfmUHIMVpBqxeDnNBj2uoeI4EbYP4i6n68SG4I=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
+github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
+github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
+github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
+github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
+github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
+github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
+github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
@@ -24,14 +24,26 @@ def load_session_history(run_dir: Path, agent_ids: Any) -> list[tuple[str, dict[
    if not agents_db.exists() or not session_ids:
        return []
    session_id_set = set(session_ids)
+    # Open read-only: the scan process may be actively writing this WAL database
+    # from another process (the local viewer tails it live), and a reader must
+    # never lock or mutate it. mode=ro (not immutable=1) still reads the latest
+    # committed WAL state; WAL permits concurrent readers alongside the writer.
+    conn: sqlite3.Connection | None = None
    try:
-        with sqlite3.connect(agents_db) as conn:
-            rows = conn.execute(
-                "select id, session_id, message_data, created_at from agent_messages order by id"
-            ).fetchall()
+        conn = sqlite3.connect(
+            f"file:{agents_db}?mode=ro",
+            uri=True,
+            check_same_thread=False,
+        )
+        rows = conn.execute(
+            "select id, session_id, message_data, created_at from agent_messages order by id"
+        ).fetchall()
    except sqlite3.Error:
        logger.exception("Failed to hydrate TUI history from %s", agents_db)
        return []
+    finally:
+        if conn is not None:
+            conn.close()

    items: list[tuple[str, dict[str, Any], str]] = []
    for row_id, agent_id, message_data, created_at in rows:
@@ -0,0 +1,253 @@
+package app
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/usestrix/strix/tui/internal/protocol"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+type agentTreeEntry struct {
+	index  int
+	depth  int
+	prefix string
+}
+
+// agentTreeEntries mirrors Textual Tree's depth-first ordering while retaining
+// each agent's snapshot index for event lookup and commands.
+func agentTreeEntries(agents []protocol.Agent, collapsed map[string]bool) []agentTreeEntry {
+	indexByID := make(map[string]int, len(agents))
+	for i, agent := range agents {
+		indexByID[agent.ID] = i
+	}
+	children := make(map[int][]int, len(agents))
+	var roots []int
+	for i, agent := range agents {
+		parentIndex := -1
+		if agent.ParentID != nil {
+			if candidate, ok := indexByID[*agent.ParentID]; ok && candidate != i {
+				parentIndex = candidate
+			}
+		}
+		if parentIndex < 0 {
+			roots = append(roots, i)
+		} else {
+			children[parentIndex] = append(children[parentIndex], i)
+		}
+	}
+
+	entries := make([]agentTreeEntry, 0, len(agents))
+	visited := make(map[int]bool, len(agents))
+	var hideDescendants func(int)
+	hideDescendants = func(index int) {
+		for _, child := range children[index] {
+			if visited[child] {
+				continue
+			}
+			visited[child] = true
+			hideDescendants(child)
+		}
+	}
+	var walk func(int, int, []bool, bool)
+	walk = func(index, depth int, continuations []bool, isLast bool) {
+		if visited[index] {
+			return
+		}
+		visited[index] = true
+		var prefix strings.Builder
+		if depth > 0 {
+			for _, continues := range continuations {
+				if continues {
+					prefix.WriteString("│  ")
+				} else {
+					prefix.WriteString("   ")
+				}
+			}
+			if isLast {
+				prefix.WriteString("└─ ")
+			} else {
+				prefix.WriteString("├─ ")
+			}
+		}
+		entries = append(entries, agentTreeEntry{index: index, depth: depth, prefix: prefix.String()})
+		if collapsed[agents[index].ID] {
+			hideDescendants(index)
+			return
+		}
+		nextContinuations := continuations
+		if depth > 0 {
+			nextContinuations = append(append([]bool(nil), continuations...), !isLast)
+		}
+		for i, child := range children[index] {
+			walk(child, depth+1, nextContinuations, i == len(children[index])-1)
+		}
+	}
+	for i, root := range roots {
+		walk(root, 0, nil, i == len(roots)-1)
+	}
+	// Malformed cycles have no root. Keep their nodes visible rather than losing
+	// them, treating the first unvisited node as another root.
+	for i := range agents {
+		if !visited[i] {
+			walk(i, 0, nil, true)
+		}
+	}
+	return entries
+}
+
+func hasAgentChildren(agentID string, agents []protocol.Agent) bool {
+	for _, agent := range agents {
+		if agent.ParentID != nil && *agent.ParentID == agentID {
+			return true
+		}
+	}
+	return false
+}
+
+func windowStart(offset, length, size int) int {
+	return min(max(0, offset), max(0, length-size))
+}
+
+func selectedAgentRow(entries []agentTreeEntry, selectedIndex int) int {
+	for row, entry := range entries {
+		if entry.index == selectedIndex {
+			return row
+		}
+	}
+	return 0
+}
+
+func selectedAgentIndex(agents []protocol.Agent, selectedID string) int {
+	if selectedID != "" {
+		for i, agent := range agents {
+			if agent.ID == selectedID {
+				return i
+			}
+		}
+	}
+	return 0
+}
+
+func (m Model) selectedAgentID() string {
+	if m.selectedAgent >= 0 && m.selectedAgent < len(m.snapshot.Agents) {
+		return m.snapshot.Agents[m.selectedAgent].ID
+	}
+	return ""
+}
+
+func (m Model) selectedAgentCanStop() bool {
+	if m.selectedAgent < 0 || m.selectedAgent >= len(m.snapshot.Agents) {
+		return false
+	}
+	switch m.snapshot.Agents[m.selectedAgent].Status {
+	case "running", "waiting", "budget_paused":
+		return true
+	default:
+		return false
+	}
+}
+
+func (m Model) agentsView(width, height int) string {
+	// The tree's root ("Agents") is hidden (show_root = False), so no header row
+	// is drawn — only the agent nodes.
+	var lines []string
+	statusIcons := map[string]string{"running": "⚪", "waiting": "⏸", "budget_paused": "⏸", "completed": "🟢", "failed": "🔴", "crashed": "🔴", "stopped": "■"}
+	entries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+	start := windowStart(m.agentOffset, len(entries), height)
+	end := min(len(entries), start+height)
+	for _, entry := range entries[start:end] {
+		agent := m.snapshot.Agents[entry.index]
+		icon := statusIcons[agent.Status]
+		if icon == "" {
+			icon = "○"
+		}
+		vulnSuffix := ""
+		if count := m.agentVulnCount(agent.ID); count > 0 {
+			vulnSuffix = fmt.Sprintf(" (%d)", count)
+		}
+		// Only a node with children carries a toggle; a leaf renders none at all,
+		// so its icon sits where its parent's toggle would be.
+		disclosure := ""
+		if hasAgentChildren(agent.ID, m.snapshot.Agents) {
+			disclosure = "▼ "
+			if m.collapsedAgents[agent.ID] {
+				disclosure = "▶ "
+			}
+		}
+		label := disclosure + icon + " " + agent.Name + vulnSuffix
+		// The guides are dim and stay outside the cursor; the cursor is a filled
+		// block behind the label alone.
+		labelStyle := lipgloss.NewStyle().Foreground(treeLabel)
+		if entry.index == m.selectedAgent {
+			labelStyle = labelStyle.Foreground(treeCursorFg).Background(treeCursorBg).Bold(true)
+		}
+		room := max(1, width-lipgloss.Width(entry.prefix))
+		lines = append(lines,
+			lipgloss.NewStyle().Foreground(treeGuide).Render(entry.prefix)+
+				labelStyle.Render(truncate(label, room)))
+	}
+	return strings.Join(lines, "\n")
+}
+
+// agentVulnCount counts vulnerabilities attributed to an agent, matching the
+// " (N)" suffix _update_agent_node appends to each tree node.
+func (m Model) agentVulnCount(agentID string) int {
+	count := 0
+	for _, vuln := range m.snapshot.Vulnerabilities {
+		if render.StringValue(vuln["agent_id"]) == agentID {
+			count++
+		}
+	}
+	return count
+}
+
+func (m *Model) ensureAgentVisible() {
+	entries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+	if len(entries) == 0 {
+		m.agentOffset = 0
+		return
+	}
+	_, _, agentHeight := m.sidebarHeights()
+	rows := max(1, agentHeight-4)
+	row := selectedAgentRow(entries, m.selectedAgent)
+	if row < m.agentOffset {
+		m.agentOffset = row
+	} else if row >= m.agentOffset+rows {
+		m.agentOffset = row - rows + 1
+	}
+	m.agentOffset = min(m.agentOffset, max(0, len(entries)-rows))
+}
+
+func (m Model) agentPageSize() int {
+	_, _, agentHeight := m.sidebarHeights()
+	return max(1, agentHeight-4)
+}
+
+func (m *Model) keepAgentSelectionInWindow() {
+	entries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+	if len(entries) == 0 {
+		return
+	}
+	rows := m.agentPageSize()
+	row := selectedAgentRow(entries, m.selectedAgent)
+	if row < m.agentOffset {
+		m.selectedAgent = entries[m.agentOffset].index
+	} else if row >= m.agentOffset+rows {
+		m.selectedAgent = entries[min(len(entries)-1, m.agentOffset+rows-1)].index
+	}
+}
+
+func (m Model) agentHasEvents(agentID string) bool {
+	for _, event := range m.snapshot.Events {
+		if event.AgentID == agentID {
+			return true
+		}
+	}
+	return false
+}
+
+// sweepView ports _get_sweep_animation: a triangle-wave sweep of six squares
+// across an 8-color palette (dimmest shows a "·"), matching the Python cadence
+// and motion exactly.
@@ -0,0 +1,250 @@
+package app
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"reflect"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+const (
+	maxCommandBytes    = 64 << 10
+	maxCollectionBytes = 4 << 20
+)
+
+var ErrCommandPending = errors.New("command is already pending")
+
+type Client struct {
+	conn           io.ReadWriteCloser
+	mu             sync.Mutex
+	seq            atomic.Uint64
+	pending        map[string]string
+	pendingByKey   map[string]string
+	requestKeyByID map[string]string
+}
+
+// ConnectInherited opens the connected socket descriptor passed by the Python
+// parent. No listener, network address, or authentication secret is involved.
+func ConnectInherited(fdValue string) (*Client, error) {
+	fd, err := strconv.ParseUint(fdValue, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("invalid STRIX_TUI_FD: %w", err)
+	}
+	file := os.NewFile(uintptr(fd), "strix-tui-ipc")
+	if file == nil {
+		return nil, fmt.Errorf("invalid STRIX_TUI_FD %d", fd)
+	}
+	connection, err := net.FileConn(file)
+	_ = file.Close()
+	if err != nil {
+		return nil, fmt.Errorf("open inherited TUI connection: %w", err)
+	}
+	return newClient(connection), nil
+}
+
+func newClient(connection io.ReadWriteCloser) *Client {
+	return &Client{
+		conn:           connection,
+		pending:        map[string]string{},
+		pendingByKey:   map[string]string{},
+		requestKeyByID: map[string]string{},
+	}
+}
+
+// ConnectFromEnvironment selects the private transport prepared by the Python
+// parent. POSIX uses an inherited descriptor; Windows uses an authenticated
+// one-use loopback connection because pass_fds is unavailable there.
+func ConnectFromEnvironment() (*Client, error) {
+	if fd := os.Getenv("STRIX_TUI_FD"); fd != "" {
+		_ = os.Unsetenv("STRIX_TUI_FD")
+		return ConnectInherited(fd)
+	}
+
+	address := os.Getenv("STRIX_TUI_ADDR")
+	token := os.Getenv("STRIX_TUI_TOKEN")
+	_ = os.Unsetenv("STRIX_TUI_ADDR")
+	_ = os.Unsetenv("STRIX_TUI_TOKEN")
+	if address == "" || token == "" {
+		return nil, fmt.Errorf("STRIX_TUI_FD or STRIX_TUI_ADDR and STRIX_TUI_TOKEN are required")
+	}
+
+	connection, err := net.DialTimeout("tcp", address, 10*time.Second)
+	if err != nil {
+		return nil, fmt.Errorf("connect to TUI backend: %w", err)
+	}
+	if err := writeAll(connection, []byte(token)); err != nil {
+		connection.Close()
+		return nil, fmt.Errorf("authenticate to TUI backend: %w", err)
+	}
+	return newClient(connection), nil
+}
+
+func writeAll(writer io.Writer, data []byte) error {
+	for len(data) > 0 {
+		n, err := writer.Write(data)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		data = data[n:]
+	}
+	return nil
+}
+
+func (c *Client) readEnvelope(maximum uint32) (protocol.Envelope, int, error) {
+	var header [4]byte
+	if _, err := io.ReadFull(c.conn, header[:]); err != nil {
+		return protocol.Envelope{}, 0, err
+	}
+	size := binary.BigEndian.Uint32(header[:])
+	if size == 0 || size > maximum {
+		return protocol.Envelope{}, 0, fmt.Errorf("invalid TUI IPC message size: %d", size)
+	}
+	raw := make([]byte, size)
+	if _, err := io.ReadFull(c.conn, raw); err != nil {
+		return protocol.Envelope{}, 0, err
+	}
+	var envelope protocol.Envelope
+	if err := json.Unmarshal(raw, &envelope); err != nil {
+		return protocol.Envelope{}, 0, err
+	}
+	return envelope, int(size), nil
+}
+
+func (c *Client) Read() (protocol.Envelope, error) {
+	envelope, size, err := c.readEnvelope(maxCollectionBytes)
+	if err != nil {
+		return protocol.Envelope{}, err
+	}
+	if envelope.Type != "collection_bootstrap" && envelope.Type != "collection_delta" && size > maxCommandBytes {
+		return protocol.Envelope{}, fmt.Errorf("TUI control message exceeds %d bytes", maxCommandBytes)
+	}
+	return envelope, nil
+}
+
+// Handshake validates the exact v3 hello and acknowledges readiness. main calls
+// this before constructing Bubble Tea, so mismatch errors never enter alt screen.
+func (c *Client) Handshake() error {
+	if connection, ok := c.conn.(interface{ SetDeadline(time.Time) error }); ok {
+		if err := connection.SetDeadline(time.Now().Add(10 * time.Second)); err != nil {
+			return err
+		}
+		defer connection.SetDeadline(time.Time{}) //nolint:errcheck
+	}
+	envelope, _, err := c.readEnvelope(maxCommandBytes)
+	if err != nil {
+		return fmt.Errorf("read protocol hello: %w", err)
+	}
+	if envelope.Version != protocol.Version {
+		return fmt.Errorf("protocol mismatch: backend=%d client=%d", envelope.Version, protocol.Version)
+	}
+	if envelope.Type != "hello" {
+		return fmt.Errorf("protocol handshake expected hello, received %q", envelope.Type)
+	}
+	var hello protocol.Hello
+	if err := json.Unmarshal(envelope.Payload, &hello); err != nil {
+		return fmt.Errorf("decode protocol hello: %w", err)
+	}
+	if !reflect.DeepEqual(hello.Capabilities, protocol.Capabilities) {
+		return fmt.Errorf("protocol capability mismatch")
+	}
+	payload, err := json.Marshal(protocol.Hello{Capabilities: protocol.Capabilities})
+	if err != nil {
+		return err
+	}
+	return c.sendEnvelope(protocol.Envelope{
+		Version: protocol.Version,
+		Type:    "ready",
+		Payload: payload,
+	}, maxCommandBytes)
+}
+
+func (c *Client) sendEnvelope(envelope protocol.Envelope, maximum int) error {
+	raw, err := json.Marshal(envelope)
+	if err != nil {
+		return err
+	}
+	if len(raw) > maximum {
+		return fmt.Errorf("TUI IPC message exceeds %d bytes", maximum)
+	}
+	framed := make([]byte, 4+len(raw))
+	binary.BigEndian.PutUint32(framed[:4], uint32(len(raw)))
+	copy(framed[4:], raw)
+	return writeAll(c.conn, framed)
+}
+
+func pendingKey(command string, payload json.RawMessage) string {
+	if command == "collection.resync" {
+		return command + ":" + string(payload)
+	}
+	return command
+}
+
+func (c *Client) Send(command string, payload any) (string, error) {
+	rawPayload, err := json.Marshal(payload)
+	if err != nil {
+		return "", err
+	}
+	requestID := fmt.Sprintf("go-%d", c.seq.Add(1))
+	envelope := protocol.Envelope{
+		Version: protocol.Version, Type: command, RequestID: requestID, Payload: rawPayload,
+	}
+	key := pendingKey(command, rawPayload)
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.pending == nil {
+		c.pending = map[string]string{}
+		c.pendingByKey = map[string]string{}
+		c.requestKeyByID = map[string]string{}
+	}
+	if existing := c.pendingByKey[key]; existing != "" {
+		return "", fmt.Errorf("%w: %s (%s)", ErrCommandPending, command, existing)
+	}
+	c.pending[requestID] = command
+	c.pendingByKey[key] = requestID
+	c.requestKeyByID[requestID] = key
+	if err := c.sendEnvelope(envelope, maxCommandBytes); err != nil {
+		delete(c.pending, requestID)
+		delete(c.pendingByKey, key)
+		delete(c.requestKeyByID, requestID)
+		return "", err
+	}
+	return requestID, nil
+}
+
+// Resolve accepts only the exact request/command pair that was submitted.
+// Unknown or mismatched results remain inert and do not release pending state.
+func (c *Client) Resolve(requestID, command string) bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if requestID == "" || c.pending[requestID] != command {
+		return false
+	}
+	key := c.requestKeyByID[requestID]
+	delete(c.pending, requestID)
+	delete(c.pendingByKey, key)
+	delete(c.requestKeyByID, requestID)
+	return true
+}
+
+func (c *Client) ExpectedCommand(requestID string) (string, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	command, ok := c.pending[requestID]
+	return command, ok
+}
+
+func (c *Client) Close() error { return c.conn.Close() }
@@ -0,0 +1,284 @@
+package app
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+func writeEnvelopeFrame(writer io.Writer, envelope protocol.Envelope) error {
+	raw, err := json.Marshal(envelope)
+	if err != nil {
+		return err
+	}
+	var header [4]byte
+	binary.BigEndian.PutUint32(header[:], uint32(len(raw)))
+	return writeAll(writer, append(header[:], raw...))
+}
+
+func readEnvelopeFrame(reader io.Reader) (protocol.Envelope, error) {
+	var header [4]byte
+	if _, err := io.ReadFull(reader, header[:]); err != nil {
+		return protocol.Envelope{}, err
+	}
+	raw := make([]byte, binary.BigEndian.Uint32(header[:]))
+	if _, err := io.ReadFull(reader, raw); err != nil {
+		return protocol.Envelope{}, err
+	}
+	var envelope protocol.Envelope
+	return envelope, json.Unmarshal(raw, &envelope)
+}
+
+func TestHandshakeValidatesHelloAndSendsReady(t *testing.T) {
+	server, connection := net.Pipe()
+	client := newClient(connection)
+	serverErr := make(chan error, 1)
+	go func() {
+		defer server.Close()
+		payload, _ := json.Marshal(protocol.Hello{Capabilities: protocol.Capabilities})
+		if err := writeEnvelopeFrame(server, protocol.Envelope{Version: protocol.Version, Type: "hello", Payload: payload}); err != nil {
+			serverErr <- err
+			return
+		}
+		var header [4]byte
+		if _, err := io.ReadFull(server, header[:]); err != nil {
+			serverErr <- err
+			return
+		}
+		raw := make([]byte, binary.BigEndian.Uint32(header[:]))
+		if _, err := io.ReadFull(server, raw); err != nil {
+			serverErr <- err
+			return
+		}
+		var ready protocol.Envelope
+		if err := json.Unmarshal(raw, &ready); err != nil {
+			serverErr <- err
+			return
+		}
+		var readyPayload protocol.Hello
+		if err := json.Unmarshal(ready.Payload, &readyPayload); err != nil {
+			serverErr <- err
+			return
+		}
+		if ready.Type != "ready" || ready.Version != protocol.Version || !reflect.DeepEqual(readyPayload.Capabilities, protocol.Capabilities) {
+			serverErr <- fmt.Errorf("unexpected ready: %#v %#v", ready, readyPayload)
+			return
+		}
+		serverErr <- nil
+	}()
+
+	if err := client.Handshake(); err != nil {
+		t.Fatal(err)
+	}
+	if err := <-serverErr; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHandshakeRejectsMismatchBeforeReady(t *testing.T) {
+	server, connection := net.Pipe()
+	client := newClient(connection)
+	go func() {
+		defer server.Close()
+		payload, _ := json.Marshal(protocol.Hello{Capabilities: []string{"state-revisions"}})
+		_ = writeEnvelopeFrame(server, protocol.Envelope{Version: 2, Type: "hello", Payload: payload})
+	}()
+
+	err := client.Handshake()
+	if err == nil || !strings.Contains(err.Error(), "protocol mismatch") {
+		t.Fatalf("handshake error = %v, want protocol mismatch", err)
+	}
+}
+
+func TestReadRejectsOversizedCollectionLengthBeforePayload(t *testing.T) {
+	server, connection := net.Pipe()
+	client := newClient(connection)
+	written := make(chan error, 1)
+	go func() {
+		var header [4]byte
+		binary.BigEndian.PutUint32(header[:], maxCollectionBytes+1)
+		_, err := server.Write(header[:])
+		written <- err
+	}()
+
+	_, err := client.Read()
+	if err == nil || !strings.Contains(err.Error(), "invalid TUI IPC message size") {
+		t.Fatalf("read error = %v", err)
+	}
+	if err := <-written; err != nil {
+		t.Fatal(err)
+	}
+	server.Close()
+}
+
+func TestClientPreventsDuplicateCommandsAndRequiresExactCorrelation(t *testing.T) {
+	connection := &recordingConn{}
+	client := newClient(connection)
+	requestID, err := client.Send("setup.select_model", map[string]string{"model": "openai/gpt-5"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.Send("setup.select_model", map[string]string{"model": "openai/gpt-5.1"}); !errors.Is(err, ErrCommandPending) {
+		t.Fatalf("duplicate error = %v, want ErrCommandPending", err)
+	}
+	if client.Resolve("unknown", "setup.select_model") || client.Resolve(requestID, "models.list") {
+		t.Fatal("unknown or mismatched result resolved pending request")
+	}
+	if !client.Resolve(requestID, "setup.select_model") {
+		t.Fatal("exact result did not resolve pending request")
+	}
+	if _, err := client.Send("setup.select_model", map[string]string{"model": "openai/gpt-5.1"}); err != nil {
+		t.Fatalf("command remained blocked after success: %v", err)
+	}
+}
+
+func TestClientRejectsOversizedCommandBeforeWrite(t *testing.T) {
+	connection := &recordingConn{}
+	client := newClient(connection)
+	_, err := client.Send("setup.set_instruction", map[string]string{"instruction": strings.Repeat("x", maxCommandBytes)})
+	if err == nil || !strings.Contains(err.Error(), "exceeds") {
+		t.Fatalf("oversized send error = %v", err)
+	}
+	if connection.Len() != 0 || len(client.pending) != 0 {
+		t.Fatal("oversized command was written or left pending")
+	}
+}
+
+func TestClientReadsCollectionFrameLargerThanOneMegabyte(t *testing.T) {
+	server, connection := net.Pipe()
+	client := &Client{conn: connection}
+	payload, err := json.Marshal(map[string]string{"content": string(bytes.Repeat([]byte("x"), 2<<20))})
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, err := json.Marshal(protocol.Envelope{
+		Version: protocol.Version,
+		Type:    "collection_bootstrap",
+		Payload: payload,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	writeErr := make(chan error, 1)
+	go func() {
+		defer server.Close()
+		var header [4]byte
+		binary.BigEndian.PutUint32(header[:], uint32(len(raw)))
+		if _, err := server.Write(header[:]); err != nil {
+			writeErr <- err
+			return
+		}
+		_, err := server.Write(raw)
+		writeErr <- err
+	}()
+
+	message, err := client.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if message.Type != "collection_bootstrap" {
+		t.Fatalf("message type = %q, want collection_bootstrap", message.Type)
+	}
+	if err := <-writeErr; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestConnectFromEnvironmentAuthenticatesTCPTransport(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+
+	t.Setenv("STRIX_TUI_ADDR", listener.Addr().String())
+	t.Setenv("STRIX_TUI_TOKEN", "one-use-token")
+	t.Setenv("STRIX_TUI_FD", "")
+
+	serverErr := make(chan error, 1)
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			serverErr <- acceptErr
+			return
+		}
+		defer connection.Close()
+		token := make([]byte, len("one-use-token"))
+		if _, readErr := io.ReadFull(connection, token); readErr != nil {
+			serverErr <- readErr
+			return
+		}
+		if string(token) != "one-use-token" {
+			serverErr <- os.ErrPermission
+			return
+		}
+		raw, marshalErr := json.Marshal(protocol.Envelope{
+			Version: protocol.Version,
+			Type:    "hello",
+			Payload: json.RawMessage(`{}`),
+		})
+		if marshalErr != nil {
+			serverErr <- marshalErr
+			return
+		}
+		var header [4]byte
+		binary.BigEndian.PutUint32(header[:], uint32(len(raw)))
+		if writeErr := writeAll(connection, append(header[:], raw...)); writeErr != nil {
+			serverErr <- writeErr
+			return
+		}
+		serverErr <- nil
+	}()
+
+	client, err := ConnectFromEnvironment()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+	message, err := client.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if message.Type != "hello" {
+		t.Fatalf("message type = %q, want hello", message.Type)
+	}
+	if err := <-serverErr; err != nil {
+		t.Fatal(err)
+	}
+	if os.Getenv("STRIX_TUI_ADDR") != "" || os.Getenv("STRIX_TUI_TOKEN") != "" {
+		t.Fatal("TCP transport credentials were not removed from the environment")
+	}
+}
+
+func TestConnectFromEnvironmentRequiresCompleteTransport(t *testing.T) {
+	t.Setenv("STRIX_TUI_FD", "")
+	t.Setenv("STRIX_TUI_ADDR", "127.0.0.1:1")
+	t.Setenv("STRIX_TUI_TOKEN", "")
+
+	_, err := ConnectFromEnvironment()
+	if err == nil || !strings.Contains(err.Error(), "STRIX_TUI_ADDR and STRIX_TUI_TOKEN") {
+		t.Fatalf("error = %v, want missing transport error", err)
+	}
+}
+
+func TestConnectFromEnvironmentPrefersInheritedDescriptor(t *testing.T) {
+	t.Setenv("STRIX_TUI_FD", "not-a-number")
+	t.Setenv("STRIX_TUI_ADDR", "127.0.0.1:1")
+	t.Setenv("STRIX_TUI_TOKEN", "token")
+
+	_, err := ConnectFromEnvironment()
+	if err == nil || !strings.Contains(err.Error(), "invalid STRIX_TUI_FD") {
+		t.Fatalf("error = %v, want inherited descriptor parse error", err)
+	}
+}
@@ -0,0 +1,299 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+func findingsModel(t *testing.T, titles ...string) Model {
+	t.Helper()
+	m := New(nil)
+	m.width, m.height = 130, 30
+	m.showSplash = false
+	m.handleEnvelope(stateEnvelope(t, 1, protocol.Snapshot{ScanState: "running"}))
+	items := make([]json.RawMessage, 0, len(titles))
+	for i, title := range titles {
+		items = append(items, rawJSON(t, map[string]any{
+			"id": string(rune('a' + i)), "title": title, "severity": "high",
+		}))
+	}
+	m.handleEnvelope(protocol.Envelope{Version: protocol.Version, Type: "collection_bootstrap",
+		Payload: rawJSON(t, protocol.CollectionBootstrap{
+			Collection: "vulnerabilities", Revision: 1, Cursor: 0,
+			NextCursor: len(items), Done: true, Items: items,
+		})})
+	m.resizeViewport()
+	return m
+}
+
+// The list scrolls by row, not by finding. Stepping a whole entry at a time is
+// what made a list of wrapped titles feel paginated.
+func TestFindingsScrollByRow(t *testing.T) {
+	long := "A deliberately long finding title that wraps across several rows in the sidebar"
+	m := findingsModel(t, long, long, long)
+
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	if len(rows) <= 3 {
+		t.Fatalf("titles did not wrap, so this proves nothing: %d rows", len(rows))
+	}
+	total, offset := m.vulnerabilityScrollRows()
+	if total != len(rows) || offset != 0 {
+		t.Fatalf("scroll metrics are not in rows: total=%d offset=%d rows=%d", total, offset, len(rows))
+	}
+
+	// One step of the offset moves one row, and the first visible line follows it.
+	first := strings.Split(ansi.Strip(m.vulnerabilitiesView(40, 4)), "\n")[0]
+	m.vulnOffset = 1
+	second := strings.Split(ansi.Strip(m.vulnerabilitiesView(40, 4)), "\n")[0]
+	if first == second {
+		t.Fatalf("advancing one row did not move the list: %q", first)
+	}
+	// That row still belongs to the first finding, which an item-stepping list
+	// would have skipped past entirely.
+	if got := m.vulnerabilityIndexAtRow(0); got != 0 {
+		t.Fatalf("one row in, the top line belongs to finding %d, want 0", got)
+	}
+}
+
+// Selecting a finding scrolls the least it can, and never past its own start.
+func TestSelectingAFindingBringsItIntoView(t *testing.T) {
+	long := "A deliberately long finding title that wraps across several rows in the sidebar"
+	m := findingsModel(t, long, long, long, long)
+
+	m.selectedVuln = 3
+	m.ensureVulnerabilityVisible()
+
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	height := m.vulnerabilityPageSize()
+	end := min(len(rows), m.vulnOffset+height)
+	found := false
+	for _, row := range rows[m.vulnOffset:end] {
+		if row.index == 3 {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("the selected finding is not on screen: offset=%d height=%d", m.vulnOffset, height)
+	}
+	if m.vulnOffset > len(rows)-height && len(rows) > height {
+		t.Fatalf("scrolled past the end: offset=%d rows=%d height=%d", m.vulnOffset, len(rows), height)
+	}
+}
+
+func reportModel(t *testing.T, count int) Model {
+	t.Helper()
+	titles := make([]string, 0, count)
+	for i := range count {
+		titles = append(titles, fmt.Sprintf("Finding number %d", i+1))
+	}
+	m := findingsModel(t, titles...)
+	m.openModal(modalVulnerability)
+	return m
+}
+
+// The open report can be stepped through the list without closing it.
+func TestReportStepsBetweenFindings(t *testing.T) {
+	m := reportModel(t, 3)
+
+	updated, _ := m.updateModal(tea.KeyMsg{Type: tea.KeyRight})
+	m = updated.(Model)
+	if m.selectedVuln != 1 {
+		t.Fatalf("right moved to %d, want 1", m.selectedVuln)
+	}
+	if m.modal != modalVulnerability {
+		t.Fatal("stepping closed the report")
+	}
+	updated, _ = m.updateModal(tea.KeyMsg{Type: tea.KeyLeft})
+	m = updated.(Model)
+	if m.selectedVuln != 0 {
+		t.Fatalf("left moved to %d, want 0", m.selectedVuln)
+	}
+}
+
+// The ends do not wrap: rolling from the last report to the first would hide
+// that you had reached the end.
+func TestReportStepsStopAtTheEnds(t *testing.T) {
+	m := reportModel(t, 3)
+
+	updated, _ := m.updateModal(tea.KeyMsg{Type: tea.KeyLeft})
+	m = updated.(Model)
+	if m.selectedVuln != 0 {
+		t.Fatalf("left from the first report moved to %d, want 0", m.selectedVuln)
+	}
+
+	m.selectedVuln = 2
+	updated, _ = m.updateModal(tea.KeyMsg{Type: tea.KeyRight})
+	m = updated.(Model)
+	if m.selectedVuln != 2 {
+		t.Fatalf("right from the last report moved to %d, want 2", m.selectedVuln)
+	}
+}
+
+// Each direction is offered only when there is a report that way, and a lone
+// finding is offered neither.
+func TestReportNavigationHintsFollowAvailability(t *testing.T) {
+	m := reportModel(t, 3)
+	for _, testCase := range []struct {
+		index              int
+		wantPrev, wantNext bool
+		position           string
+	}{
+		{index: 0, wantNext: true, position: "1/3"},
+		{index: 1, wantPrev: true, wantNext: true, position: "2/3"},
+		{index: 2, wantPrev: true, position: "3/3"},
+	} {
+		m.selectedVuln = testCase.index
+		view := ansi.Strip(m.modalView())
+		if !strings.Contains(view, testCase.position) {
+			t.Fatalf("report %d does not show %q", testCase.index, testCase.position)
+		}
+		if got := strings.Contains(view, reportPrev); got != testCase.wantPrev {
+			t.Fatalf("report %d prev hint = %v, want %v", testCase.index, got, testCase.wantPrev)
+		}
+		if got := strings.Contains(view, reportNext); got != testCase.wantNext {
+			t.Fatalf("report %d next hint = %v, want %v", testCase.index, got, testCase.wantNext)
+		}
+	}
+
+	lone := reportModel(t, 1)
+	view := ansi.Strip(lone.modalView())
+	if strings.Contains(view, reportPrev) || strings.Contains(view, reportNext) || strings.Contains(view, "1/1") {
+		t.Fatalf("a lone finding offered navigation:\n%s", view)
+	}
+}
+
+// A new report opens at its top, and the copy state does not carry over.
+func TestSteppingResetsTheReportView(t *testing.T) {
+	m := reportModel(t, 3)
+	m.vulnerabilityCopied = true
+	m.vulnViewport.SetYOffset(3)
+
+	m.showVulnerability(1)
+
+	if m.vulnViewport.YOffset != 0 {
+		t.Fatalf("the next report opened scrolled to %d", m.vulnViewport.YOffset)
+	}
+	if m.vulnerabilityCopied {
+		t.Fatal("the copy state carried over to another report")
+	}
+}
+
+// Prev and Next are buttons, not just key hints: they can be clicked.
+func TestReportStepButtonsAreClickable(t *testing.T) {
+	m := reportModel(t, 3)
+	m.selectedVuln = 1
+
+	click := func(label string) Model {
+		t.Helper()
+		view := m.modalView()
+		left, top, _, _ := m.centeredViewBounds(view)
+		for row, line := range strings.Split(view, "\n") {
+			plain := ansi.Strip(line)
+			index := strings.Index(plain, label)
+			if index < 0 {
+				continue
+			}
+			updated, _ := m.updateModalMouse(tea.MouseMsg{
+				X: left + ansi.StringWidth(plain[:index]) + 1, Y: top + row,
+				Button: tea.MouseButtonLeft, Action: tea.MouseActionPress,
+			})
+			return updated.(Model)
+		}
+		t.Fatalf("%q was not rendered", label)
+		return m
+	}
+
+	if got := click(reportNext).selectedVuln; got != 2 {
+		t.Fatalf("clicking Next selected %d, want 2", got)
+	}
+	if got := click(reportPrev).selectedVuln; got != 0 {
+		t.Fatalf("clicking Prev selected %d, want 0", got)
+	}
+	if got := click(reportNext).modal; got != modalVulnerability {
+		t.Fatalf("clicking Next closed the report: modal=%v", got)
+	}
+}
+
+// Tab walks the whole row, so the step buttons are reachable from the keyboard
+// as well, and Enter presses whichever one is focused.
+func TestTabReachesTheStepButtons(t *testing.T) {
+	m := reportModel(t, 3)
+	m.selectedVuln = 1
+
+	if got := m.focusedReportButton(); got != reportDone {
+		t.Fatalf("the report opened focused on %q, want %q", got, reportDone)
+	}
+	seen := map[string]bool{}
+	for range len(m.reportButtons()) {
+		updated, _ := m.updateModal(tea.KeyMsg{Type: tea.KeyTab})
+		m = updated.(Model)
+		seen[m.focusedReportButton()] = true
+	}
+	for _, want := range []string{reportPrev, reportNext, reportCopy, reportDone} {
+		if !seen[want] {
+			t.Fatalf("tab never reached %q: %v", want, seen)
+		}
+	}
+
+	// Enter on a focused step button steps.
+	m.reportFocus = reportNext
+	updated, _ := m.updateModal(tea.KeyMsg{Type: tea.KeyEnter})
+	if got := updated.(Model).selectedVuln; got != 2 {
+		t.Fatalf("enter on Next selected %d, want 2", got)
+	}
+}
+
+// Stepping to an end drops that button from the row; focus must not be stranded
+// on it.
+func TestFocusFallsBackWhenAStepButtonDisappears(t *testing.T) {
+	m := reportModel(t, 2)
+	m.selectedVuln = 0
+	m.reportFocus = reportNext
+
+	updated, _ := m.updateModal(tea.KeyMsg{Type: tea.KeyEnter})
+	m = updated.(Model)
+
+	if m.selectedVuln != 1 {
+		t.Fatalf("enter on Next selected %d, want 1", m.selectedVuln)
+	}
+	// Next is gone at the last report, so the focus cannot still be on it.
+	if got := m.focusedReportButton(); got == reportNext {
+		t.Fatalf("focus stayed on a button that is no longer shown: %q", got)
+	}
+	if got := m.focusedReportButton(); got != reportDone {
+		t.Fatalf("focus fell back to %q, want %q", got, reportDone)
+	}
+}
+
+// The list must be laid out at one width. Rendering at one and hit-testing at
+// another gives two different row counts for the same title, and then a click
+// resolves to the wrong finding and the scrollbar reports the wrong length.
+func TestFindingsUseOneWidthForRenderAndInteraction(t *testing.T) {
+	// This title wraps to one row at 21 columns and two at 20, which is exactly
+	// the pair of widths the two paths used to disagree on.
+	m := findingsModel(t, "ffffff dddd a a a a", "eeeee eeeee a a a a", "header dddd a a a a")
+
+	width := m.vulnerabilityListWidth()
+	rows := m.vulnerabilityRows(width)
+	rendered := strings.Split(ansi.Strip(m.vulnerabilitiesView(width, len(rows))), "\n")
+
+	if len(rendered) != len(rows) {
+		t.Fatalf("rendered %d rows, interaction counts %d", len(rendered), len(rows))
+	}
+	for row := range rendered {
+		if got := m.vulnerabilityIndexAtRow(row); got != rows[row].index {
+			t.Fatalf("row %d shows finding %d but a click resolves to %d",
+				row, rows[row].index, got)
+		}
+	}
+	if total, _ := m.vulnerabilityScrollRows(); total != len(rendered) {
+		t.Fatalf("the scrollbar reports %d rows, %d are rendered", total, len(rendered))
+	}
+}
@@ -0,0 +1,98 @@
+package app
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"image"
+	"image/color"
+	"image/png"
+	"testing"
+
+	"github.com/usestrix/strix/tui/internal/protocol"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+func benchImageDataURI(b *testing.B, w, h int) string {
+	b.Helper()
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	for y := range h {
+		for x := range w {
+			img.Set(x, y, color.RGBA{R: uint8(x), G: uint8(y), B: 0x40, A: 0xff})
+		}
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		b.Fatal(err)
+	}
+	return "data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes())
+}
+
+// BenchmarkChatContentWithImages measures a frame render for a trace holding
+// many inline images, the case that made the TUI unresponsive.
+func BenchmarkChatContentWithImages(b *testing.B) {
+	supported := render.KittyGraphicsSupported
+	render.KittyGraphicsSupported = func() bool { return true }
+	b.Cleanup(func() { render.KittyGraphicsSupported = supported })
+
+	model := New(nil)
+	model.width, model.height = 130, 40
+	model.showSplash = false
+	model.ready = true
+	events := make([]protocol.Event, 0, 20)
+	for i := range 20 {
+		events = append(events, protocol.Event{
+			ID: fmt.Sprintf("%d", i), AgentID: "one", Type: "tool",
+			Data: map[string]any{
+				"tool_name": "view_image",
+				"args":      map[string]any{"path": fmt.Sprintf("/tmp/shot-%d.png", i)},
+				"result":    benchImageDataURI(b, 2000+i, 1400),
+				"status":    "completed",
+			},
+		})
+	}
+	model.snapshot = protocol.Snapshot{
+		Agents: []protocol.Agent{{ID: "one", Name: "Agent", Status: "running"}},
+		Events: events,
+	}
+	model.resizeViewport()
+
+	b.ResetTimer()
+	for b.Loop() {
+		_ = model.View()
+	}
+}
+
+func BenchmarkFrameWithImagesAfterUpdate(b *testing.B) {
+	supported := render.KittyGraphicsSupported
+	render.KittyGraphicsSupported = func() bool { return true }
+	b.Cleanup(func() { render.KittyGraphicsSupported = supported })
+
+	model := New(nil)
+	model.width, model.height = 130, 40
+	model.showSplash = false
+	model.ready = true
+	events := make([]protocol.Event, 0, 20)
+	for i := range 20 {
+		events = append(events, protocol.Event{
+			ID: fmt.Sprintf("%d", i), AgentID: "one", Type: "tool",
+			Data: map[string]any{
+				"tool_name": "view_image",
+				"args":      map[string]any{"path": fmt.Sprintf("/tmp/shot-%d.png", i)},
+				"result":    benchImageDataURI(b, 2000+i, 1400),
+				"status":    "completed",
+			},
+		})
+	}
+	model.snapshot = protocol.Snapshot{
+		Agents: []protocol.Agent{{ID: "one", Name: "Agent", Status: "running"}},
+		Events: events,
+	}
+	model.resizeViewport()
+
+	b.ResetTimer()
+	for b.Loop() {
+		model.refreshViewport()
+		_ = model.View()
+	}
+}
@@ -0,0 +1,216 @@
+package app
+
+import (
+	"strings"
+	"testing"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+func inputModel(t *testing.T) Model {
+	t.Helper()
+	model := New(nil)
+	model.showSplash = false
+	model.ready = true
+	model.width, model.height = 130, 40
+	model.resizeViewport()
+	return model
+}
+
+func TestInputGrowsWithContentUpToCap(t *testing.T) {
+	model := inputModel(t)
+	// The live composer opens at a single row, out of the trace's way.
+	if got := model.input.Height(); got != 1 {
+		t.Fatalf("empty composer height = %d, want 1", got)
+	}
+	model.input.SetValue(strings.Repeat("line\n", 4) + "line")
+	model.resizeViewport()
+	if got := model.input.Height(); got != 5 {
+		t.Fatalf("5-line composer height = %d, want 5", got)
+	}
+	model.input.SetValue(strings.Repeat("line\n", 19) + "line")
+	model.resizeViewport()
+	if got := model.input.Height(); got != maxInputLines {
+		t.Fatalf("20-line composer height = %d, want %d", got, maxInputLines)
+	}
+}
+
+// The launch composer opens with room to breathe; the live one stays a single
+// row until there is something to show, as it always has.
+func TestComposerOpeningHeightPerMode(t *testing.T) {
+	live := inputModel(t)
+	if got := live.input.Height(); got != 1 {
+		t.Fatalf("live composer opens at %d rows, want 1", got)
+	}
+
+	setup := inputModel(t)
+	setup.snapshot.SetupMode = true
+	setup.resizeViewport()
+	if got := setup.input.Height(); got != minInputLines {
+		t.Fatalf("launch composer opens at %d rows, want %d", got, minInputLines)
+	}
+}
+
+// A prompt with no newline in it still has to grow the composer once it wraps.
+func TestInputGrowsWithSoftWrappedLine(t *testing.T) {
+	for _, setup := range []bool{false, true} {
+		model := inputModel(t)
+		model.snapshot.SetupMode = setup
+		model.resizeViewport()
+		floor, _ := model.composerBounds()
+		if got := model.input.Height(); got != floor {
+			t.Fatalf("setup=%v: empty composer height = %d, want floor %d", setup, got, floor)
+		}
+		width := model.input.Width()
+		model.input.SetValue(strings.Repeat("x", width*5-1))
+		model.resizeViewport()
+		// Five rows of text; the textarea adds a trailing row when the last one
+		// is full, so the cursor stays visible.
+		if got := model.input.Height(); got < 5 || got > 6 {
+			t.Fatalf("setup=%v: wrapped composer height = %d, want 5 or 6", setup, got)
+		}
+		model.input.SetValue(strings.Repeat("x", width*maxInputLines*2))
+		model.resizeViewport()
+		if got := model.input.Height(); got != maxInputLines {
+			t.Fatalf("setup=%v: overlong composer height = %d, want %d", setup, got, maxInputLines)
+		}
+	}
+}
+
+// The composer never takes more than a third of a short terminal.
+func TestInputHeightCappedOnShortTerminal(t *testing.T) {
+	model := inputModel(t)
+	model.width, model.height = 130, 15
+	model.input.SetValue(strings.Repeat("line\n", 10) + "line")
+	model.resizeViewport()
+	if got := model.input.Height(); got != 5 {
+		t.Fatalf("composer height on a 15-row terminal = %d, want 5", got)
+	}
+}
+
+// The rendered frame must be exactly the terminal size at every step of
+// typing. A composer that renders one cell too wide gets re-wrapped into an
+// extra row, which pushes the frame past the bottom of the terminal and makes
+// the screen jump at wrap points.
+func TestFrameFitsTerminalWhileTyping(t *testing.T) {
+	sizes := [][2]int{{130, 40}, {100, 30}, {80, 24}}
+	for _, setup := range []bool{false, true} {
+		for _, size := range sizes {
+			model := New(nil)
+			model.showSplash, model.ready, model.focus = false, true, focusInput
+			model.width, model.height = size[0], size[1]
+			model.snapshot = protocol.Snapshot{SetupMode: setup, Model: "anthropic/claude-sonnet-4-5"}
+			if !setup {
+				model.snapshot.Agents = []protocol.Agent{{ID: "a1", Name: "recon", Status: "running"}}
+			}
+			model.resizeViewport()
+			for i, r := range strings.Repeat("alpha bravo charlie delta echo foxtrot ", 6) {
+				updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune{r}})
+				model = updated.(Model)
+				rows := strings.Split(model.View(), "\n")
+				if len(rows) != size[1] {
+					t.Fatalf("setup=%v %v: after %d chars the frame is %d rows, want %d",
+						setup, size, i+1, len(rows), size[1])
+				}
+				for row, line := range rows {
+					if width := lipgloss.Width(line); width != size[0] {
+						t.Fatalf("setup=%v %v: after %d chars row %d is %d cells, want %d",
+							setup, size, i+1, row, width, size[0])
+					}
+				}
+			}
+		}
+	}
+}
+
+// The launch column is anchored: growing the composer must not walk the
+// wordmark and the prompt up the screen.
+func TestLaunchColumnHoldsStillWhileComposerGrows(t *testing.T) {
+	model := New(nil)
+	model.showSplash, model.ready, model.focus = false, true, focusInput
+	model.width, model.height = 130, 40
+	model.snapshot = protocol.Snapshot{SetupMode: true}
+	model.resizeViewport()
+	composerRow := func() int {
+		for row, line := range strings.Split(ansi.Strip(model.View()), "\n") {
+			if strings.Contains(line, "╭") {
+				return row
+			}
+		}
+		return -1
+	}
+	want := composerRow()
+	for i, r := range strings.Repeat("alpha bravo charlie delta echo ", 12) {
+		updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune{r}})
+		model = updated.(Model)
+		if got := composerRow(); got != want {
+			t.Fatalf("after %d chars the composer moved to row %d, want %d (height %d)",
+				i+1, got, want, model.input.Height())
+		}
+	}
+	if model.input.Height() < 5 {
+		t.Fatalf("composer only grew to %d rows; the test is not exercising growth", model.input.Height())
+	}
+}
+
+func TestCtrlJInsertsNewline(t *testing.T) {
+	model := inputModel(t)
+	model.input.SetValue("hello")
+	updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyCtrlJ})
+	model = updated.(Model)
+	if got := model.input.Value(); got != "hello\n" {
+		t.Fatalf("value after ctrl+j = %q, want %q", got, "hello\n")
+	}
+}
+
+func TestEnterSubmitsTrimmedMultilineMessage(t *testing.T) {
+	model := inputModel(t)
+	model.input.SetValue("first\nsecond ")
+	updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	model = updated.(Model)
+	if got := model.input.Value(); got != "" {
+		t.Fatalf("composer not cleared after submit: %q", got)
+	}
+	if got := model.input.Height(); got != 1 {
+		t.Fatalf("composer height after submit = %d, want 1", got)
+	}
+}
+
+func TestDragSelectionInInputCopiesText(t *testing.T) {
+	model := inputModel(t)
+	copied := ""
+	original := writeClipboard
+	writeClipboard = func(text string) error {
+		copied = text
+		return nil
+	}
+	defer func() { writeClipboard = original }()
+
+	model.input.SetValue("copy me please")
+	model.resizeViewport()
+	top := model.inputTop()
+
+	updated, _ := model.updateMouse(tea.MouseMsg{
+		X: 4, Y: top + 1, Button: tea.MouseButtonLeft, Action: tea.MouseActionPress,
+	})
+	model = updated.(Model)
+	if !model.selection.dragging || model.selection.region != regionInput {
+		t.Fatalf("press in the composer did not start an input selection: %+v", model.selection)
+	}
+	updated, _ = model.updateMouse(tea.MouseMsg{X: 10, Y: top + 1, Action: tea.MouseActionMotion})
+	model = updated.(Model)
+	updated, cmd := model.updateMouse(tea.MouseMsg{Action: tea.MouseActionRelease})
+	model = updated.(Model)
+	if cmd == nil {
+		t.Fatal("input selection release produced no copy command")
+	}
+	if msg, ok := cmd().(selectionCopiedMsg); !ok || msg.err != nil {
+		t.Fatalf("unexpected copy result: %#v", cmd())
+	}
+	if copied != "copy me" {
+		t.Fatalf("copied %q, want %q", copied, "copy me")
+	}
+}
@@ -0,0 +1,410 @@
+package app
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/atotto/clipboard"
+	"github.com/charmbracelet/bubbles/key"
+	"github.com/charmbracelet/bubbles/textarea"
+	"github.com/charmbracelet/bubbles/viewport"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+type wireMsg protocol.Envelope
+type wireErrMsg struct{ err error }
+type sentMsg struct {
+	requestID  string
+	command    string
+	collection string
+	err        error
+}
+type splashTickMsg time.Time
+type sweepTickMsg time.Time
+type vulnerabilityCopiedMsg struct{ err error }
+
+var writeClipboard = clipboard.WriteAll
+
+type collectionAssembly struct {
+	kind         string
+	revision     int
+	baseRevision int
+	cursor       int
+	agents       []protocol.Agent
+	events       []protocol.Event
+	findings     []map[string]any
+	operations   []protocol.CollectionOperation
+	ids          map[string]bool
+}
+
+// appVersion is the package version string shown on the splash and stats panel.
+// It is set by main from the STRIX_VERSION env var (see go_tui.py), matching
+// Python's get_package_version() which reads the installed "strix-agent" version
+// and falls back to "dev".
+var appVersion = "dev"
+
+// SetVersion overrides the displayed version; empty values are ignored so the
+// "dev" fallback survives when the launcher does not provide one.
+func SetVersion(v string) {
+	if strings.TrimSpace(v) != "" {
+		appVersion = strings.TrimSpace(v)
+	}
+}
+
+type modalMode int
+
+const (
+	modalNone modalMode = iota
+	modalHelp
+	modalQuit
+	modalStop
+	modalConfirmMount
+	modalVulnerability
+)
+
+type focusMode int
+
+const (
+	focusInput focusMode = iota
+	focusChat
+	focusAgents
+	focusVulnerabilities
+)
+
+type scrollbarTarget int
+
+const (
+	scrollbarNone scrollbarTarget = iota
+	scrollbarTrace
+	scrollbarAgents
+	scrollbarFindings
+)
+
+type Model struct {
+	client                 *Client
+	width, height          int
+	snapshot               protocol.Snapshot
+	input                  textarea.Model
+	viewport               viewport.Model
+	viewportContent        string
+	vulnViewport           viewport.Model
+	modal                  modalMode
+	focus                  focusMode
+	options                []string
+	filtered               []string
+	cursor                 int
+	collapsedAgents        map[string]bool
+	expandedEvents         map[string]bool
+	blockCache             map[string]renderedBlock
+	eventSpans             []eventSpan
+	setupLog               []string
+	pendingPrompt          string
+	errorText              string
+	fatalError             error
+	selectedAgent          int
+	selectedVuln           int
+	agentOffset            int
+	vulnOffset             int
+	modalChoice            int
+	reportFocus            string
+	ready                  bool
+	quitting               bool
+	showSplash             bool
+	splashStarted          time.Time
+	splashFrame            int
+	sweepFrame             int
+	budgetPauseNotified    bool
+	followOutput           bool
+	selection              selectionState
+	toast                  string
+	toastID                int
+	draggingScrollbar      scrollbarTarget
+	stateRevision          int
+	collectionRevisions    map[string]int
+	collectionAssemblies   map[string]*collectionAssembly
+	resyncRequested        map[string]bool
+	resyncRequests         map[string]string
+	seenMessages           map[string]bool
+	vulnerabilityCopied    bool
+	vulnerabilityCopyError string
+}
+
+var (
+	green       = lipgloss.Color("#22c55e")
+	brightGreen = lipgloss.Color("#4ade80")
+	blue        = lipgloss.Color("#3b82f6")
+	lightBlue   = lipgloss.Color("#60a5fa")
+	red         = lipgloss.Color("#ef4444")
+	orange      = lipgloss.Color("#ea580c")
+	amber       = lipgloss.Color("#d97706")
+	white       = lipgloss.Color("#fafaf9")
+	brightWhite = lipgloss.Color("#ffffff")
+	textColor   = lipgloss.Color("#d4d4d4")
+	dim         = lipgloss.Color("#737373")
+	mid         = lipgloss.Color("#a3a3a3")
+	dark        = lipgloss.Color("#333333")
+	black       = lipgloss.Color("#000000")
+)
+
+// Agent tree colors: a uniform label, dim guides, and a filled block cursor.
+const (
+	treeLabel    = lipgloss.Color("#e7e5e4")
+	treeGuide    = lipgloss.Color("#4f4f4f")
+	treeCursorFg = lipgloss.Color("#ddedf9")
+	treeCursorBg = lipgloss.Color("#0178d4")
+)
+
+// Scrollbar thumbs. The track stays blank so a scrollable panel does not gain a
+// visible rule down its edge, and the thumb brightens while it is dragged, which
+// is the feedback Textual gave through scrollbar-color-active.
+//
+// One resting color for every panel, rather than the three the stylesheet named.
+// The chat pane's was #1a1a1a on black, which is invisible - the bar could not be
+// found, let alone grabbed (#1005).
+const (
+	thumbResting = lipgloss.Color("#3f3f46")
+	thumbActive  = lipgloss.Color("#9ca3af")
+)
+
+// Composer placeholders. The launch screen falls back to the short prompt when
+// the column is too narrow to show the full one without clipping it.
+const (
+	setupPlaceholder      = "Describe what to test, or name a target"
+	setupPlaceholderShort = "What should Strix test?"
+	chatPlaceholder       = "Send a message"
+)
+
+// The composer opens at minInputLines rows for breathing room and grows with
+// its content up to maxInputLines.
+const (
+	minInputLines = 3
+	maxInputLines = 8
+)
+
+// newChatInput builds the multi-line chat composer. Enter submits (handled by
+// the update loop before the textarea sees it); Shift/Alt+Enter and Ctrl+J
+// insert a newline.
+func newChatInput() textarea.Model {
+	input := textarea.New()
+	input.ShowLineNumbers = false
+	input.CharLimit = 4096
+	input.MaxHeight = maxInputLines
+	input.SetHeight(1)
+	input.KeyMap.InsertNewline = key.NewBinding(
+		key.WithKeys("shift+enter", "alt+enter", "ctrl+j"),
+		key.WithHelp("shift+enter", "insert newline"),
+	)
+	plain := lipgloss.NewStyle()
+	text := lipgloss.NewStyle().Foreground(textColor)
+	placeholder := lipgloss.NewStyle().Foreground(lipgloss.Color("#525252"))
+	for _, style := range []*textarea.Style{&input.FocusedStyle, &input.BlurredStyle} {
+		style.Base = plain
+		style.CursorLine = text
+		style.EndOfBuffer = plain
+		style.Placeholder = placeholder
+		style.Text = text
+	}
+	input.FocusedStyle.Prompt = lipgloss.NewStyle().Bold(true).Foreground(green)
+	input.BlurredStyle.Prompt = lipgloss.NewStyle().Foreground(dim)
+	input.SetPromptFunc(2, func(lineIdx int) string {
+		if lineIdx == 0 {
+			return "> "
+		}
+		return "  "
+	})
+	input.Cursor.Style = lipgloss.NewStyle().Foreground(green)
+	return input
+}
+
+// composerBounds returns the floor and ceiling row counts for the composer at
+// the current terminal height. A short terminal shrinks the ceiling so a long
+// prompt cannot crowd out everything above it.
+//
+// Only the launch screen opens taller than a single row: there the composer is
+// the whole screen and wants breathing room, while during a scan it sits under
+// the trace and stays out of the way until there is something to show.
+func (m Model) composerBounds() (floor, ceiling int) {
+	ceiling = maxInputLines
+	if m.height > 0 {
+		ceiling = max(minInputLines, min(maxInputLines, m.height/3))
+	}
+	floor = 1
+	if m.snapshot.SetupMode {
+		floor = min(minInputLines, ceiling)
+	}
+	return floor, ceiling
+}
+
+// syncInputHeight grows or shrinks the composer with its content, between the
+// floor and ceiling.
+func (m *Model) syncInputHeight() {
+	floor, ceiling := m.composerBounds()
+	m.input.SetHeight(max(floor, min(composerHeight(m.input), ceiling)))
+}
+
+// composerHeight is how many rows the composer needs to show all of its
+// content, capped at maxInputLines. Soft-wrapped rows count: a single long
+// line still grows the box. LineCount only counts hard newlines, and the
+// wrapped height the textarea does report covers just the line the cursor is
+// on, so a scratch copy measures each line with the composer's own wrapping.
+func composerHeight(input textarea.Model) int {
+	probe, rows := input, 0
+	for _, line := range strings.Split(input.Value(), "\n") {
+		// A line narrower than the text column cannot wrap, which is the case
+		// for nearly every keystroke; only measure the ones that might.
+		if ansi.StringWidth(line) < input.Width() {
+			rows++
+		} else {
+			probe.SetValue(line)
+			rows += probe.LineInfo().Height
+		}
+		if rows >= maxInputLines {
+			return maxInputLines
+		}
+	}
+	return max(1, rows)
+}
+
+func New(client *Client) Model {
+	input := newChatInput()
+	input.Placeholder = setupPlaceholder
+	input.Focus()
+	return Model{
+		client: client, input: input, viewport: viewport.New(80, 20), vulnViewport: viewport.New(80, 20),
+		collapsedAgents: map[string]bool{}, expandedEvents: map[string]bool{}, blockCache: map[string]renderedBlock{}, showSplash: true, splashStarted: time.Now(), followOutput: true,
+		collectionRevisions: map[string]int{}, collectionAssemblies: map[string]*collectionAssembly{}, resyncRequested: map[string]bool{}, resyncRequests: map[string]string{},
+		seenMessages: map[string]bool{},
+	}
+}
+
+func (m Model) Init() tea.Cmd { return tea.Batch(readWire(m.client), splashTick(), sweepTick()) }
+
+// splashTick drives the splash "Starting Strix Agent" shimmer at Python's 0.1s cadence.
+func splashTick() tea.Cmd {
+	return tea.Tick(100*time.Millisecond, func(t time.Time) tea.Msg { return splashTickMsg(t) })
+}
+
+// sweepTick drives the running-status sweep animation at Python's 0.06s cadence.
+func sweepTick() tea.Cmd {
+	return tea.Tick(60*time.Millisecond, func(t time.Time) tea.Msg { return sweepTickMsg(t) })
+}
+
+func readWire(client *Client) tea.Cmd {
+	return func() tea.Msg {
+		envelope, err := client.Read()
+		if err != nil {
+			return wireErrMsg{err}
+		}
+		return wireMsg(envelope)
+	}
+}
+
+func send(client *Client, command string, payload any) tea.Cmd {
+	return func() tea.Msg {
+		requestID, err := client.Send(command, payload)
+		collection := ""
+		if values, ok := payload.(map[string]any); ok {
+			collection, _ = values["collection"].(string)
+		}
+		return sentMsg{requestID: requestID, command: command, collection: collection, err: err}
+	}
+}
+
+func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
+	switch msg := msg.(type) {
+	case splashTickMsg:
+		m.splashFrame++
+		if m.showSplash && time.Since(m.splashStarted) >= 4500*time.Millisecond {
+			m.showSplash = false
+		}
+		return m, splashTick()
+	case sweepTickMsg:
+		m.sweepFrame++
+		return m, sweepTick()
+	case tea.WindowSizeMsg:
+		m.width, m.height = msg.Width, msg.Height
+		m.resizeViewport()
+		m.resizeVulnerabilityViewport()
+		m.ensureAgentVisible()
+		m.ensureVulnerabilityVisible()
+	case wireErrMsg:
+		if !m.quitting {
+			m.errorText = "Backend disconnected: " + msg.err.Error()
+			m.fatalError = fmt.Errorf("backend disconnected: %w", msg.err)
+		}
+		return m, tea.Quit
+	case wireMsg:
+		envelope := protocol.Envelope(msg)
+		if envelope.Version != protocol.Version {
+			m.errorText = fmt.Sprintf("Protocol mismatch: backend=%d client=%d", envelope.Version, protocol.Version)
+			m.fatalError = fmt.Errorf("protocol mismatch: backend=%d client=%d", envelope.Version, protocol.Version)
+			return m, tea.Quit
+		}
+		if cmd := m.handleEnvelope(envelope); cmd != nil {
+			cmds = append(cmds, cmd)
+		}
+		cmds = append(cmds, readWire(m.client))
+	case sentMsg:
+		if msg.err != nil {
+			m.errorText = msg.err.Error()
+			if msg.command == "collection.resync" && msg.collection != "" {
+				m.resyncRequested[msg.collection] = false
+			}
+		} else if msg.command == "collection.resync" && msg.requestID != "" && msg.collection != "" {
+			m.resyncRequests[msg.requestID] = msg.collection
+		}
+	case selectionCopiedMsg:
+		text := "Copied to clipboard"
+		if msg.err != nil {
+			text = "Copy failed: " + msg.err.Error()
+		}
+		return m, m.showToast(text)
+	case toastExpiredMsg:
+		if msg.id == m.toastID {
+			m.toast = ""
+			if !m.selection.dragging {
+				m.selection.active = false
+			}
+		}
+		return m, nil
+	case vulnerabilityCopiedMsg:
+		m.vulnerabilityCopied = msg.err == nil
+		m.vulnerabilityCopyError = ""
+		if msg.err != nil {
+			m.vulnerabilityCopyError = msg.err.Error()
+		}
+		return m, nil
+	case tea.KeyMsg:
+		if m.showSplash {
+			switch msg.String() {
+			case "ctrl+c", "ctrl+q", "q", "esc":
+				m.quitting = true
+				return m, tea.Batch(send(m.client, "app.quit", map[string]any{}), tea.Quit)
+			}
+			m.showSplash = false
+			return m, nil
+		}
+		if m.modal != modalNone {
+			return m.updateModal(msg)
+		}
+		return m.updateMain(msg)
+	case tea.MouseMsg:
+		if m.showSplash || !m.ready {
+			return m, nil
+		}
+		return m.updateMouse(msg)
+	}
+	var cmd tea.Cmd
+	if m.modal == modalNone {
+		m.input, cmd = m.input.Update(msg)
+	}
+	cmds = append(cmds, cmd)
+	return m, tea.Batch(cmds...)
+}
+
+func (m Model) FatalError() error { return m.fatalError }
@@ -0,0 +1,284 @@
+package app
+
+// In-app text selection for the chat trace, in the tmux copy-mode style:
+// drag with the left mouse button to highlight text, and the plain-text
+// selection lands on the clipboard when the button is released. Coordinates
+// are anchored to content lines, so an active selection survives scrolling.
+
+import (
+	"strings"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/x/ansi"
+)
+
+type selectionCopiedMsg struct{ err error }
+
+type toastExpiredMsg struct{ id int }
+
+// toastDuration matches the old Textual notify("Copied to clipboard", timeout=2).
+const toastDuration = 2 * time.Second
+
+// showToast displays a transient notification and schedules its dismissal;
+// the copy highlight is cleared together with the toast.
+func (m *Model) showToast(text string) tea.Cmd {
+	return m.showToastFor(text, toastDuration)
+}
+
+func (m *Model) showToastFor(text string, duration time.Duration) tea.Cmd {
+	m.toastID++
+	m.toast = text
+	id := m.toastID
+	return tea.Tick(duration, func(time.Time) tea.Msg { return toastExpiredMsg{id: id} })
+}
+
+type selectionRegion int
+
+const (
+	regionChat selectionRegion = iota
+	regionInput
+)
+
+type selectionState struct {
+	active   bool
+	dragging bool
+	region   selectionRegion
+	// Content-line coordinates: anchor is where the drag started, head is
+	// where the pointer currently is.
+	anchorLine, anchorCol int
+	headLine, headCol     int
+}
+
+// bounds returns the selection in reading order: (fromLine, fromCol) to
+// (toLine, toCol), with toCol exclusive.
+func (s selectionState) bounds() (fromLine, fromCol, toLine, toCol int) {
+	if s.anchorLine < s.headLine || (s.anchorLine == s.headLine && s.anchorCol <= s.headCol) {
+		return s.anchorLine, s.anchorCol, s.headLine, s.headCol + 1
+	}
+	return s.headLine, s.headCol, s.anchorLine, s.anchorCol + 1
+}
+
+// styleSelected uses reverse video directly so the highlight renders on any
+// terminal profile.
+func styleSelected(text string) string {
+	return "\x1b[7m" + text + "\x1b[27m"
+}
+
+// chatContentCell maps main-view screen coordinates to a content cell inside
+// the chat trace, honoring the pane border and the scroll offset.
+func (m Model) chatContentCell(x, y int) (line, col int, ok bool) {
+	_, _, chatWidth, chatHeight := m.layout()
+	traceHeight := chatHeight - 2
+	if x < 1 || x > chatWidth-2 || y < 1 || y > traceHeight {
+		return 0, 0, false
+	}
+	return m.viewport.YOffset + y - 1, x - 1, true
+}
+
+// inputPromptWidth is the composer prompt ("> " / "  ") column width; input
+// selection coordinates are relative to the text after it.
+const inputPromptWidth = 2
+
+// inputTop returns the screen row of the composer's top border in the main view.
+func (m Model) inputTop() int {
+	_, _, _, chatHeight := m.layout()
+	statusH := 0
+	if m.statusVisible() {
+		statusH = 1
+	}
+	return chatHeight + statusH
+}
+
+// inputContentCell maps main-view screen coordinates to a text cell inside
+// the composer, honoring the border, padding, and prompt columns.
+func (m Model) inputContentCell(x, y int) (line, col int, ok bool) {
+	_, _, chatWidth, _ := m.layout()
+	top := m.inputTop()
+	textLeft := 2 + inputPromptWidth // border + padding, then the prompt
+	if x < textLeft || x > chatWidth-2 || y <= top || y > top+m.input.Height() {
+		return 0, 0, false
+	}
+	return y - top - 1, x - textLeft, true
+}
+
+func (m *Model) beginSelection(region selectionRegion, line, col int) {
+	m.selection = selectionState{
+		active: true, dragging: true, region: region,
+		anchorLine: line, anchorCol: col,
+		headLine: line, headCol: col,
+	}
+	m.toast = ""
+}
+
+func (m *Model) extendSelection(line, col int) {
+	m.selection.headLine = max(0, line)
+	m.selection.headCol = max(0, col)
+}
+
+// finishSelection ends the drag and copies the highlighted text; a plain
+// click (no movement) clears any previous highlight and, in the chat trace,
+// toggles the clicked tool's collapsed state.
+func (m *Model) finishSelection() tea.Cmd {
+	m.selection.dragging = false
+	if m.selection.anchorLine == m.selection.headLine && m.selection.anchorCol == m.selection.headCol {
+		region := m.selection.region
+		line := m.selection.anchorLine
+		m.selection.active = false
+		if region == regionChat {
+			m.toggleEventAtLine(line)
+		}
+		return nil
+	}
+	text := m.selectedText()
+	if text == "" {
+		m.selection.active = false
+		return nil
+	}
+	if m.selection.region == regionChat {
+		if cleaned := cleanCopiedText(text); strings.TrimSpace(cleaned) != "" {
+			text = cleaned
+		}
+	}
+	return func() tea.Msg {
+		return selectionCopiedMsg{err: writeClipboard(text)}
+	}
+}
+
+// iconPrefixes and decorativeLines port StrixTUIApp._ICON_PREFIXES and
+// _DECORATIVE_LINES: UI ornaments dropped from copied chat text.
+// kittyPlaceholderRune marks kitty graphics placeholder cells, which carry no
+// copyable text.
+const kittyPlaceholderRune = 0x10eeee
+
+var iconPrefixes = []string{
+	"🐞 ", "🌐 ", "📋 ", "🧠 ", "◆ ", "◇ ", "◈ ", "→ ", "○ ", "● ", "✓ ", "✗ ",
+	"⚠ ", "▍ ", "▍", "┃ ", "• ", ">_ ", "</> ", "<~> ", "[ ] ", "[~] ", "[•] ",
+}
+
+var decorativeLines = map[string]bool{
+	"● In progress...": true,
+	"✓ Done":           true,
+	"✗ Failed":         true,
+	"✗ Error":          true,
+	"○ Unknown":        true,
+}
+
+// cleanCopiedText ports _clean_copied_text: drop decorative status lines and
+// horizontal rules, and strip leading UI icons while keeping indentation.
+func cleanCopiedText(text string) string {
+	var cleaned []string
+	for _, line := range strings.Split(text, "\n") {
+		stripped := strings.TrimLeft(line, " \t")
+		if decorativeLines[stripped] {
+			continue
+		}
+		if stripped != "" && strings.Trim(stripped, "─") == "" {
+			continue
+		}
+		if strings.ContainsRune(stripped, kittyPlaceholderRune) {
+			continue
+		}
+		out := line
+		for _, prefix := range iconPrefixes {
+			if strings.HasPrefix(stripped, prefix) {
+				leading := line[:len(line)-len(stripped)]
+				out = leading + stripped[len(prefix):]
+				break
+			}
+		}
+		cleaned = append(cleaned, out)
+	}
+	return strings.Join(cleaned, "\n")
+}
+
+// toggleEventAtLine expands or collapses the tool event rendered at the given
+// chat content line.
+func (m *Model) toggleEventAtLine(line int) {
+	for _, span := range m.eventSpans {
+		if line >= span.start && line <= span.end {
+			m.expandedEvents[span.eventID] = !m.expandedEvents[span.eventID]
+			m.refreshViewport()
+			return
+		}
+	}
+}
+
+func (m Model) selectedText() string {
+	fromLine, fromCol, toLine, toCol := m.selection.bounds()
+	source := m.viewportContent
+	if m.selection.region == regionInput {
+		source = m.inputText()
+	}
+	lines := strings.Split(source, "\n")
+	var out []string
+	for i := max(0, fromLine); i <= min(toLine, len(lines)-1); i++ {
+		left, right := 0, ansi.StringWidth(lines[i])
+		if i == fromLine {
+			left = fromCol
+		}
+		if i == toLine {
+			right = min(right, toCol)
+		}
+		out = append(out, strings.TrimRight(ansi.Strip(ansi.Cut(lines[i], left, right)), " "))
+	}
+	return strings.TrimRight(strings.Join(out, "\n"), "\n")
+}
+
+// inputText returns the composer's visible rows without the prompt columns,
+// as the source for input-region selection.
+func (m Model) inputText() string {
+	rows := strings.Split(m.input.View(), "\n")
+	for i, row := range rows {
+		rows[i] = ansi.Cut(row, inputPromptWidth, ansi.StringWidth(row))
+	}
+	return strings.Join(rows, "\n")
+}
+
+// highlightInputSelection re-styles the selected cells of the rendered
+// composer, shifting columns past the prompt.
+func (m Model) highlightInputSelection(view string) string {
+	if !m.selection.active || m.selection.region != regionInput {
+		return view
+	}
+	return highlightRows(view, 0, m.selection, inputPromptWidth)
+}
+
+// highlightSelection re-styles the selected cells of the visible trace chunk.
+// visible holds the rows starting at content line offset.
+func (m Model) highlightSelection(visible string, offset int) string {
+	if !m.selection.active || m.selection.region != regionChat {
+		return visible
+	}
+	return highlightRows(visible, offset, m.selection, 0)
+}
+
+// highlightRows applies reverse video to the selected cells; shift moves the
+// selection columns right (for rows with a fixed prefix like the prompt).
+func highlightRows(visible string, offset int, selection selectionState, shift int) string {
+	fromLine, fromCol, toLine, toCol := selection.bounds()
+	fromCol += shift
+	toCol += shift
+	rows := strings.Split(visible, "\n")
+	for i, row := range rows {
+		line := offset + i
+		if line < fromLine || line > toLine {
+			continue
+		}
+		width := ansi.StringWidth(row)
+		left, right := shift, width
+		if line == fromLine {
+			left = min(fromCol, width)
+		}
+		if line == toLine {
+			right = min(toCol, width)
+		}
+		if right <= left {
+			continue
+		}
+		rows[i] = ansi.Cut(row, 0, left) +
+			styleSelected(ansi.Strip(ansi.Cut(row, left, right))) +
+			ansi.Cut(row, right, width)
+	}
+	return strings.Join(rows, "\n")
+}
@@ -0,0 +1,185 @@
+package app
+
+import (
+	"strings"
+	"testing"
+
+	tea "github.com/charmbracelet/bubbletea"
+
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+func selectionModel(t *testing.T) Model {
+	t.Helper()
+	model := New(nil)
+	model.showSplash = false
+	model.ready = true
+	model.width, model.height = 130, 40
+	model.snapshot.Agents = append(
+		model.snapshot.Agents,
+		protocol.Agent{ID: "root", Name: "Strix", Status: "running"},
+	)
+	model.resizeViewport()
+	model.viewportContent = strings.Join([]string{
+		" first line of the trace",
+		" second line of the trace",
+		" third line of the trace",
+	}, "\n")
+	model.viewport.SetContent(model.viewportContent)
+	return model
+}
+
+func TestDragSelectionCopiesPlainText(t *testing.T) {
+	model := selectionModel(t)
+	copied := ""
+	original := writeClipboard
+	writeClipboard = func(text string) error {
+		copied = text
+		return nil
+	}
+	defer func() { writeClipboard = original }()
+
+	updated, _ := model.updateMouse(tea.MouseMsg{
+		X: 2, Y: 1, Button: tea.MouseButtonLeft, Action: tea.MouseActionPress,
+	})
+	model = updated.(Model)
+	if !model.selection.dragging {
+		t.Fatal("press in the trace did not start a selection")
+	}
+	updated, _ = model.updateMouse(tea.MouseMsg{X: 7, Y: 2, Action: tea.MouseActionMotion})
+	model = updated.(Model)
+	updated, cmd := model.updateMouse(tea.MouseMsg{Action: tea.MouseActionRelease})
+	model = updated.(Model)
+	if cmd == nil {
+		t.Fatal("selection release produced no copy command")
+	}
+	msg := cmd()
+	if copyMsg, ok := msg.(selectionCopiedMsg); !ok || copyMsg.err != nil {
+		t.Fatalf("unexpected copy result: %#v", msg)
+	}
+	want := "first line of the trace\n second"
+	if copied != want {
+		t.Fatalf("copied %q, want %q", copied, want)
+	}
+	if model.selection.dragging || !model.selection.active {
+		t.Fatalf("selection state after release: %+v", model.selection)
+	}
+
+	updated, tick := model.Update(msg)
+	model = updated.(Model)
+	if model.toast != "Copied to clipboard" {
+		t.Fatalf("toast %q after copy", model.toast)
+	}
+	if !strings.Contains(model.View(), "Copied to clipboard") {
+		t.Fatal("toast is not rendered")
+	}
+	if tick == nil {
+		t.Fatal("toast was not scheduled to expire")
+	}
+	updated, _ = model.Update(toastExpiredMsg{id: model.toastID})
+	model = updated.(Model)
+	if model.toast != "" || model.selection.active {
+		t.Fatalf("toast expiry left toast=%q selection=%+v", model.toast, model.selection)
+	}
+}
+
+func TestPlainClickClearsSelectionWithoutCopying(t *testing.T) {
+	model := selectionModel(t)
+	original := writeClipboard
+	writeClipboard = func(string) error {
+		t.Fatal("plain click must not copy")
+		return nil
+	}
+	defer func() { writeClipboard = original }()
+
+	updated, _ := model.updateMouse(tea.MouseMsg{
+		X: 2, Y: 1, Button: tea.MouseButtonLeft, Action: tea.MouseActionPress,
+	})
+	model = updated.(Model)
+	updated, cmd := model.updateMouse(tea.MouseMsg{Action: tea.MouseActionRelease})
+	model = updated.(Model)
+	if cmd != nil {
+		t.Fatal("plain click produced a command")
+	}
+	if model.selection.active {
+		t.Fatal("plain click left an active selection")
+	}
+}
+
+func TestHighlightSelectionRestylesSelectedCells(t *testing.T) {
+	model := selectionModel(t)
+	model.selection = selectionState{
+		active:     true,
+		anchorLine: 0, anchorCol: 1,
+		headLine: 0, headCol: 5,
+	}
+
+	visible := model.highlightSelection(model.viewportContent, 0)
+	lines := strings.Split(visible, "\n")
+	if !strings.Contains(lines[0], "\x1b[") {
+		t.Fatalf("selected line was not restyled: %q", lines[0])
+	}
+	if strings.Contains(lines[1], "\x1b[") || strings.Contains(lines[2], "\x1b[") {
+		t.Fatal("unselected lines were restyled")
+	}
+}
+
+func TestSelectedTextSpansReversedDrag(t *testing.T) {
+	model := selectionModel(t)
+	model.selection = selectionState{
+		active:     true,
+		anchorLine: 2, anchorCol: 6,
+		headLine: 1, headCol: 1,
+	}
+
+	want := "second line of the trace\n third"
+	if got := model.selectedText(); got != want {
+		t.Fatalf("selected text %q, want %q", got, want)
+	}
+}
+
+func TestCleanCopiedTextStripsDecorations(t *testing.T) {
+	in := "✓ Done\n  🐞 SQL injection found\n────────\n>_ curl -s http://x\nplain line"
+	want := "  SQL injection found\ncurl -s http://x\nplain line"
+	if got := cleanCopiedText(in); got != want {
+		t.Fatalf("cleaned %q, want %q", got, want)
+	}
+}
+
+func TestClickTogglesToolExpansion(t *testing.T) {
+	model := New(nil)
+	model.showSplash = false
+	model.ready = true
+	model.width, model.height = 130, 40
+	model.snapshot.Agents = []protocol.Agent{{ID: "root", Name: "Strix", Status: "running"}}
+	var output []string
+	for i := 0; i < 20; i++ {
+		output = append(output, "output line")
+	}
+	model.snapshot.Events = []protocol.Event{{
+		ID: "ev-1", Type: "tool", AgentID: "root", Timestamp: "1",
+		Data: map[string]any{
+			"tool_name": "exec_command",
+			"status":    "completed",
+			"args":      map[string]any{"cmd": "seq 20"},
+			"result":    strings.Join(output, "\n"),
+		},
+	}}
+	model.resizeViewport()
+
+	if !strings.Contains(model.viewportContent, "click to expand") {
+		t.Fatalf("long tool output should start collapsed:\n%s", model.viewportContent)
+	}
+	if len(model.eventSpans) != 1 || model.eventSpans[0].eventID != "ev-1" {
+		t.Fatalf("expected one expandable span, got %+v", model.eventSpans)
+	}
+
+	model.toggleEventAtLine(model.eventSpans[0].start)
+	if !strings.Contains(model.viewportContent, "click to collapse") {
+		t.Fatalf("click should expand the tool:\n%s", model.viewportContent)
+	}
+	model.toggleEventAtLine(model.eventSpans[0].start)
+	if !strings.Contains(model.viewportContent, "click to expand") {
+		t.Fatal("second click should collapse again")
+	}
+}
@@ -0,0 +1,525 @@
+package app
+
+import (
+	"fmt"
+	"net"
+	"regexp"
+	"strings"
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+func (m Model) submit(value string) (tea.Model, tea.Cmd) {
+	if m.snapshot.SetupMode {
+		return m.submitSetupPrompt(value)
+	}
+	if len(m.snapshot.Agents) == 0 {
+		m.errorText = "No agent is available"
+		return m, nil
+	}
+	if m.selectedAgent >= len(m.snapshot.Agents) {
+		m.selectedAgent = 0
+	}
+	return m, send(m.client, "agent.send_message", map[string]any{"agent_id": m.snapshot.Agents[m.selectedAgent].ID, "message": value})
+}
+
+// submitSetupPrompt handles free text the way a coding agent's prompt does:
+// anything that looks like a target is added, the rest becomes the scan
+// instruction, and the prompt alone is enough to launch. With no target, the
+// backend scans the current working directory.
+func (m *Model) submitSetupPrompt(value string) (tea.Model, tea.Cmd) {
+	var commands []tea.Cmd
+	fields := strings.Fields(value)
+	targets := 0
+	for _, field := range fields {
+		token := strings.Trim(field, ",;")
+		if !looksLikeTarget(token) || m.hasTarget(token) {
+			continue
+		}
+		targets++
+		commands = append(commands, send(m.client, "setup.add_target", map[string]any{"target": token}))
+	}
+	if len(fields) > targets {
+		commands = append(commands, send(m.client, "setup.set_instruction", map[string]any{"instruction": value}))
+	}
+	// With a target, verify the model connection before the scan commits to it.
+	// A bare prompt launches optimistically, like a coding agent, and mounts the
+	// working directory - the backend asks about that from the live view, so the
+	// prompt is held here in case it is declined.
+	verify := targets > 0 || len(m.snapshot.Targets) > 0
+	payload := map[string]any{"verify": verify}
+	if verify {
+		m.setupMsg("Verifying model connection...", render.Col(amber))
+	} else {
+		m.pendingPrompt = value
+		payload["mount_working_dir"] = true
+	}
+	commands = append(commands, send(m.client, "setup.start", payload))
+	// Ordered, not batched: setup.start leaves setup mode, so it must be the
+	// last command to reach the backend. Batched sends race, and once the
+	// preflight is skipped setup.start wins, making the target and instruction
+	// commands land after the guard closes and fail with a red error.
+	return *m, tea.Sequence(commands...)
+}
+
+// answerMountConfirmation replies to the working-directory mount the backend is
+// waiting on. Declining returns to the start screen, so the prompt goes back in
+// the composer to be edited or given a target instead.
+func (m *Model) answerMountConfirmation(approved bool) tea.Cmd {
+	if !approved && m.pendingPrompt != "" {
+		m.input.SetValue(m.pendingPrompt)
+		m.resizeViewport()
+	}
+	m.pendingPrompt = ""
+	return send(m.client, "setup.confirm_mount", map[string]any{"approved": approved})
+}
+
+func (m Model) hasTarget(candidate string) bool {
+	for _, target := range m.snapshot.Targets {
+		if target == candidate {
+			return true
+		}
+	}
+	return false
+}
+
+// looksLikeTarget reports whether a whitespace-delimited token names something
+// scannable: a URL, repo, filesystem path, domain, or IP address.
+func looksLikeTarget(token string) bool {
+	if token == "" {
+		return false
+	}
+	if strings.Contains(token, "://") || strings.HasSuffix(token, ".git") {
+		return true
+	}
+	if strings.HasPrefix(token, "/") || strings.HasPrefix(token, "./") || strings.HasPrefix(token, "~/") || strings.HasPrefix(token, "../") {
+		return true
+	}
+	if ip := net.ParseIP(token); ip != nil {
+		return true
+	}
+	host := token
+	if at := strings.LastIndex(host, "@"); at >= 0 {
+		host = host[at+1:]
+	}
+	host = strings.SplitN(host, "/", 2)[0]
+	host = strings.SplitN(host, ":", 2)[0]
+	if !domainPattern.MatchString(host) {
+		return false
+	}
+	tld := host[strings.LastIndex(host, ".")+1:]
+	return len(tld) >= 2 && !isNumeric(tld)
+}
+
+var domainPattern = regexp.MustCompile(`^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z0-9]{2,}$`)
+
+func isNumeric(value string) bool {
+	for _, char := range value {
+		if char < '0' || char > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+// statusVisible mirrors #agent_status_display: shown only when an agent is
+// selected during a scan; hidden (display:none) in setup mode.
+func (m Model) statusVisible() bool {
+	return !m.snapshot.SetupMode && len(m.snapshot.Agents) > 0
+}
+
+func (m Model) layout() (showSidebar bool, sidebarWidth, chatWidth, chatHeight int) {
+	showSidebar = m.width >= 120
+	if showSidebar {
+		sidebarWidth = max(24, m.width/5)
+		chatWidth = m.width - sidebarWidth - 1
+	} else {
+		chatWidth = m.width
+	}
+	statusH := 0
+	if m.statusVisible() {
+		statusH = 1
+	}
+	chatHeight = max(4, m.height-statusH-(m.input.Height()+2))
+	return
+}
+
+// resizeViewport refits the composer and the scrollback to the terminal. The
+// composer is sized width first: how far its content wraps, and so how tall it
+// needs to be, depends on the width it is given.
+func (m *Model) resizeViewport() {
+	if m.snapshot.SetupMode {
+		contentWidth := setupColumnWidth(m.width)
+		// The composer's border and padding each take a column per side.
+		m.input.SetWidth(max(3, contentWidth-4))
+		// A clipped placeholder reads as an unfinished sentence, so a narrow
+		// composer gets the short prompt instead.
+		m.input.Placeholder = setupPlaceholder
+		if contentWidth-6 < lipgloss.Width(setupPlaceholder) {
+			m.input.Placeholder = setupPlaceholderShort
+		}
+		m.syncInputHeight()
+		m.viewport.Width = max(10, contentWidth)
+		m.viewport.Height = max(1, setupLogRows(m.setupLog))
+		m.refreshViewport()
+		return
+	}
+	_, _, chatWidth, _ := m.layout()
+	// The accent bar and its padding each take a column.
+	m.input.SetWidth(max(3, chatWidth-3))
+	m.syncInputHeight()
+	_, _, _, chatHeight := m.layout()
+	// Reserve two columns inside the border for the scrollbar gap and track.
+	m.viewport.Width = max(10, chatWidth-4)
+	m.viewport.Height = max(3, chatHeight-2)
+	m.refreshViewport()
+}
+
+func (m *Model) refreshViewport() {
+	wasBottom := m.viewport.AtBottom()
+	content := m.setupContent()
+	if !m.snapshot.SetupMode {
+		content = m.chatContent()
+	}
+	m.viewportContent = content
+	m.viewport.SetContent(content)
+	if m.followOutput && wasBottom {
+		m.viewport.GotoBottom()
+	}
+}
+
+func (m Model) setupContent() string {
+	var b strings.Builder
+	for _, line := range m.setupLog {
+		b.WriteString(line + "\n")
+	}
+	return strings.TrimSuffix(b.String(), "\n")
+}
+
+// setupLogAppend records a chronological line in the setup scrollback. A line
+// that is already there moves to the end instead of being repeated: retrying a
+// launch that cannot succeed yet - no model configured, no target - would
+// otherwise push the same pair of lines until they were all the log held.
+func (m *Model) setupLogAppend(line string) {
+	for i, existing := range m.setupLog {
+		if existing == line {
+			m.setupLog = append(m.setupLog[:i], m.setupLog[i+1:]...)
+			break
+		}
+	}
+	m.setupLog = append(m.setupLog, line)
+}
+
+// setupMsg appends a styled feedback line (success green, error red, notice dim).
+// The log budgets rows by entry, so a message is flattened to one line first: a
+// wrapped exception would otherwise render as several rows and push the launch
+// column past the bottom of the terminal.
+func (m *Model) setupMsg(text string, style lipgloss.Style) {
+	m.setupLogAppend(style.Render(flattenStatus(text)))
+}
+
+// setupLogRows is how many feedback lines the launch column shows before the
+// fit starts trimming them. It is a launch pad, not a scrollback.
+func setupLogRows(log []string) int { return min(len(log), 6) }
+
+// Logo treatments, largest last. The launch column steps down through them as
+// the terminal runs out of room.
+const (
+	logoNone = iota
+	logoCompact
+	logoFull
+)
+
+// setupColumnWidth is the width of the centered launch column. It widens to
+// the banner rather than lose it, as long as the terminal can still spare a
+// margin either side.
+func setupColumnWidth(terminal int) int {
+	width := min(72, max(24, terminal-8))
+	if terminal >= wordmarkWidth()+2 {
+		width = max(width, wordmarkWidth())
+	}
+	return width
+}
+
+// setupFit records how much of the launch column survives at the current
+// terminal size: the wordmark treatment, whether the tagline is shown, and how
+// many feedback-log rows fit.
+type setupFit struct {
+	width   int
+	logo    int
+	tagline bool
+	logRows int
+}
+
+// setupFit picks the richest layout that still fits the terminal. Sections are
+// surrendered in the order of shrink below - never the composer, which is the
+// only thing on this screen the user has to reach.
+func (m Model) setupFit() setupFit {
+	fit := setupFit{
+		width:   setupColumnWidth(m.width),
+		logo:    logoFull,
+		tagline: true,
+		logRows: setupLogRows(m.setupLog),
+	}
+	if m.width < wordmarkWidth()+2 {
+		fit.logo = logoCompact
+	}
+	if m.height < 18 {
+		fit.logo, fit.tagline = min(fit.logo, logoCompact), false
+	}
+	shrink := []func(*setupFit) bool{
+		func(f *setupFit) bool { return trimTo(&f.logRows, 3) },
+		func(f *setupFit) bool { return clearFlag(&f.tagline) },
+		func(f *setupFit) bool { return trimTo(&f.logRows, 0) },
+		func(f *setupFit) bool { return trimTo(&f.logo, logoCompact) },
+		func(f *setupFit) bool { return trimTo(&f.logo, logoNone) },
+	}
+	for step := 0; step < len(shrink) && lipgloss.Height(m.setupBody(fit)) > m.height; {
+		if !shrink[step](&fit) {
+			step++
+		}
+	}
+	return fit
+}
+
+func trimTo(value *int, floor int) bool {
+	if *value <= floor {
+		return false
+	}
+	*value--
+	return true
+}
+
+func clearFlag(flag *bool) bool {
+	if !*flag {
+		return false
+	}
+	*flag = false
+	return true
+}
+
+func (m Model) setupView() string {
+	fit := m.setupFit()
+	rows := strings.Split(m.setupBody(fit), "\n")
+	if len(rows) > m.height {
+		rows = rows[:max(0, m.height)]
+	}
+	// Anchor the column on its resting height rather than its current one, so a
+	// growing composer and new feedback both push downward.
+	// Centering on the live height walks the whole page up under the cursor,
+	// one row at a time, as the prompt wraps.
+	top := (m.height - m.setupRestingHeight(fit, len(rows))) / 2
+	top = min(max(top, 0), max(0, m.height-len(rows)))
+	left := max(0, (m.width-fit.width)/2)
+	frame := make([]string, m.height)
+	for row := range frame {
+		line := ""
+		if index := row - top; index >= 0 && index < len(rows) {
+			line = strings.Repeat(" ", left) + rows[index]
+		}
+		frame[row] = padToWidth(line, m.width)
+	}
+	return strings.Join(frame, "\n")
+}
+
+// setupRestingHeight is the column's height with the composer at its opening
+// size and the transient sections closed: the layout the screen sits at when
+// idle. Anchoring on this keeps the column still as the composer grows.
+func (m Model) setupRestingHeight(fit setupFit, height int) int {
+	floor, _ := m.composerBounds()
+	height -= max(0, m.input.Height()-floor)
+	if fit.logRows > 0 && len(m.setupLog) > 0 {
+		height -= fit.logRows + 1
+	}
+	return height
+}
+
+// setupBody stacks the launch column: wordmark, composer with its scan summary,
+// the target list, feedback and the key hints. Sections
+// are separated by a blank line; the composer and its summary read as one unit.
+func (m Model) setupBody(fit setupFit) string {
+	parts := make([]string, 0, 6)
+	if header := m.setupHeaderView(fit); header != "" {
+		parts = append(parts, header)
+	}
+	parts = append(parts, m.setupComposer(fit.width))
+	if log := m.setupLogView(fit); log != "" {
+		parts = append(parts, log)
+	}
+	parts = append(parts, m.setupHintsView(fit.width))
+	// Every row is padded to the column width: lipgloss.Place centers each line
+	// on its own, which would otherwise stagger the short rows.
+	rows := strings.Split(strings.Join(parts, "\n\n"), "\n")
+	for index, row := range rows {
+		rows[index] = padToWidth(row, fit.width)
+	}
+	return strings.Join(rows, "\n")
+}
+
+// setupHeaderView centers the wordmark over the tagline.
+func (m Model) setupHeaderView(fit setupFit) string {
+	center := lipgloss.NewStyle().Width(fit.width).Align(lipgloss.Center)
+	var rows []string
+	switch fit.logo {
+	case logoFull:
+		// The banner is tall enough to want air under it.
+		rows = append(rows, center.Render(wordmark()))
+		if fit.tagline {
+			rows = append(rows, "")
+		}
+	case logoCompact:
+		rows = append(rows, center.Render(lipgloss.NewStyle().Bold(true).Foreground(brightGreen).Render("STRIX")))
+	}
+	if fit.tagline {
+		rows = append(rows, center.Render(render.Dim().Render("Open-source AI hackers for your apps")))
+	}
+	return strings.Join(rows, "\n")
+}
+
+// banner is the Strix wordmark: block letters with a bevelled edge.
+const banner = ` ███████╗████████╗██████╗ ██╗██╗  ██╗
+ ██╔════╝╚══██╔══╝██╔══██╗██║╚██╗██╔╝
+ ███████╗   ██║   ██████╔╝██║ ╚███╔╝
+ ╚════██║   ██║   ██╔══██╗██║ ██╔██╗
+ ███████║   ██║   ██║  ██║██║██╔╝ ██╗
+ ╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝╚═╝  ╚═╝`
+
+// wordmark renders the banner in solid brand green. Every row is padded out to
+// the full block so centering cannot ripple the letterforms out of alignment.
+var wordmarkOnce = sync.OnceValue(func() string {
+	green := lipgloss.NewStyle().Foreground(green)
+	lines := strings.Split(banner, "\n")
+	rows := make([]string, len(lines))
+	for index, line := range lines {
+		rows[index] = green.Render(line + strings.Repeat(" ", wordmarkWidth()-lipgloss.Width(line)))
+	}
+	return strings.Join(rows, "\n")
+})
+
+func wordmark() string { return wordmarkOnce() }
+
+// wordmarkWidth is the cell width of the widest banner row.
+var wordmarkWidth = sync.OnceValue(func() int {
+	block := 0
+	for _, line := range strings.Split(banner, "\n") {
+		block = max(block, lipgloss.Width(line))
+	}
+	return block
+})
+
+// setupComposer draws the prompt as a rounded panel that lights up green while
+// it holds focus. The scan meta and targets live inside the panel, flush under
+// the input, so everything shares one left edge - the way opencode aligns its
+// home prompt.
+func (m Model) setupComposer(width int) string {
+	border := dark
+	if m.focus == focusInput {
+		border = green
+	}
+	// Width covers the padding but not the border, so a box of the given total
+	// width sets width-2 here and hands the interior the width-4 that is left.
+	inner := max(1, width-4)
+	body := m.highlightInputSelection(m.input.View())
+	body += "\n\n" + m.setupSummaryView(inner)
+	if targets := m.setupTargetsView(inner); targets != "" {
+		body += "\n" + targets
+	}
+	return lipgloss.NewStyle().Width(max(1, width-2)).Padding(0, 1).
+		Border(lipgloss.RoundedBorder()).BorderForeground(border).
+		Render(body)
+}
+
+// setupSummaryView is the quiet meta line inside the panel: what the scan will
+// run as, or what is still missing before it can run.
+func (m Model) setupSummaryView(width int) string {
+	chips := []string{}
+	if model := strings.TrimSpace(m.snapshot.Model); model != "" {
+		name, provider := model, ""
+		if slash := strings.LastIndex(model, "/"); slash >= 0 {
+			provider, name = model[:slash], model[slash+1:]
+		}
+		chip := render.Col(green).Render("● ") + render.Col(white).Render(name)
+		if provider != "" {
+			chips = append(chips, chip, render.Dim().Render(provider))
+		} else {
+			chips = append(chips, chip)
+		}
+	} else {
+		chips = append(chips, render.Col(amber).Render("○ no model")+
+			render.Dim().Render(" · set STRIX_LLM or configure one in your config"))
+	}
+	if m.snapshot.MaxBudgetUSD != nil {
+		chips = append(chips, render.Dim().Render(fmt.Sprintf("$%.2f budget", *m.snapshot.MaxBudgetUSD)))
+	}
+	return truncate(strings.Join(chips, render.Dim().Render(" · ")), max(1, width))
+}
+
+// setupTargetsView lists what the scan is pointed at, once anything is queued.
+func (m Model) setupTargetsView(width int) string {
+	if len(m.snapshot.Targets) == 0 {
+		return ""
+	}
+	const visible = 4
+	total := max(m.snapshot.TargetCount, len(m.snapshot.Targets))
+	rows := []string{render.Bold(green).Render("Targets") + render.Dim().Render(fmt.Sprintf(" %d", total))}
+	for _, target := range m.snapshot.Targets[:min(visible, len(m.snapshot.Targets))] {
+		rows = append(rows, render.Col(dim).Render("▸ ")+render.Col(white).Render(truncate(target, max(1, width-2))))
+	}
+	if hidden := total - visible; hidden > 0 {
+		rows = append(rows, render.Dim().Render(fmt.Sprintf("+%d more", hidden)))
+	}
+	return strings.Join(rows, "\n")
+}
+
+// setupLogView shows the tail of the feedback log. The launch screen is a
+// launch pad, not a scrollback, so only the most recent lines are kept.
+func (m Model) setupLogView(fit setupFit) string {
+	if fit.logRows <= 0 || len(m.setupLog) == 0 {
+		return ""
+	}
+	tail := m.setupLog[max(0, len(m.setupLog)-fit.logRows):]
+	rows := make([]string, 0, len(tail))
+	for _, line := range tail {
+		// Align with the panel interior [2, width-2].
+		rows = append(rows, "  "+truncate(line, max(1, fit.width-4)))
+	}
+	return strings.Join(rows, "\n")
+}
+
+// setupHintsView is the closing key hint row, aligned to the panel's inner
+// edges: keys flush under the input, the version at the far right.
+func (m Model) setupHintsView(width int) string {
+	// The panel's interior spans [2, width-2]; match it so the row reads as a
+	// footer under the input rather than a stray line.
+	const pad = "  "
+	inner := max(1, width-4)
+	key := lipgloss.NewStyle().Foreground(white).Render
+	label := render.Dim().Render
+	hint := func(k, text string) string { return key(k) + label(" "+text) }
+	left := hint("enter", "launch scan") + label("   ") + hint("ctrl+c", "quit")
+	if lipgloss.Width(left) > inner {
+		left = hint("enter", "launch scan")
+	}
+	right := label("v" + appVersion)
+	gap := inner - lipgloss.Width(left) - lipgloss.Width(right)
+	if gap < 2 {
+		return pad + left
+	}
+	return pad + left + strings.Repeat(" ", gap) + right
+}
+
+// syncMountPrompt raises or clears the working-directory prompt to match the
+// backend, which asks for it from the live view once a target-less scan is
+// waiting on the answer. Following the snapshot rather than the keystroke keeps
+// the prompt right across redraws and reconnects.
+func (m *Model) syncMountPrompt() {
+	switch {
+	case m.snapshot.PendingMount != "" && m.modal != modalConfirmMount:
+		m.openModal(modalConfirmMount)
+	case m.snapshot.PendingMount == "" && m.modal == modalConfirmMount:
+		m.closeModal()
+	}
+}
@@ -0,0 +1,117 @@
+package app
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/muesli/termenv"
+	"github.com/usestrix/strix/tui/internal/protocol"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+// Retrying a launch that cannot succeed yet must not fill the log with copies of
+// the same two lines.
+func TestSetupLogCollapsesRepeatedAttempts(t *testing.T) {
+	m := New(nil)
+	m.snapshot.SetupMode = true
+	for range 4 {
+		m.setupMsg("Verifying model connection...", render.Col(amber))
+		m.setupMsg("No model configured. Set STRIX_LLM first.", render.Col(red))
+	}
+	if got := len(m.setupLog); got != 2 {
+		t.Fatalf("setup log holds %d lines after 4 identical attempts, want 2: %#v", got, m.setupLog)
+	}
+	// The newest line stays last so the log still reads chronologically.
+	if !strings.Contains(m.setupLog[1], "No model configured") {
+		t.Fatalf("most recent line is not last: %#v", m.setupLog)
+	}
+	m.setupMsg("\u2713 Added target: https://example.com", render.Col(green))
+	if got := len(m.setupLog); got != 3 {
+		t.Fatalf("a distinct line did not append: %#v", m.setupLog)
+	}
+}
+
+// The same collapse must hold for the path a real misconfiguration takes: a
+// failing setup.start arriving as a command_result.
+func TestRepeatedSetupStartFailureLogsOnce(t *testing.T) {
+	model, _ := newCommandTestModel(t)
+	model.snapshot.SetupMode = true
+	model.client.pending = map[string]string{}
+	model.client.pendingByKey = map[string]string{}
+	model.client.requestKeyByID = map[string]string{}
+	for i := range 3 {
+		requestID := "req-" + string(rune('a'+i))
+		model.client.pending[requestID] = "setup.start"
+		model.client.pendingByKey["setup.start"] = requestID
+		model.client.requestKeyByID[requestID] = "setup.start"
+		payload, err := json.Marshal(protocol.CommandResult{
+			OK:      false,
+			Command: "setup.start",
+			Error: &protocol.CommandError{
+				Code:    "invalid_state",
+				Message: "No model configured. Set STRIX_LLM first.",
+			},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		model.handleEnvelope(protocol.Envelope{
+			Version: protocol.Version, Type: "command_result", RequestID: requestID, Payload: payload,
+		})
+	}
+	if got := len(model.setupLog); got != 1 {
+		t.Fatalf("three identical launch failures logged %d lines, want 1: %#v", got, model.setupLog)
+	}
+}
+
+// Every Tab-reachable panel shows focus with the same green border.
+func TestFocusedPanelsCarryTheGreenBorder(t *testing.T) {
+	// The profile is global; restore it so later tests still render unstyled.
+	previous := lipgloss.ColorProfile()
+	t.Cleanup(func() { lipgloss.SetColorProfile(previous) })
+	lipgloss.SetColorProfile(termenv.TrueColor)
+	borderColorsOf := func(focus focusMode) string {
+		m := New(nil)
+		m.width, m.height = 130, 30
+		m.showSplash = false
+		m.snapshot.ScanState = "running"
+		m.snapshot.Agents = []protocol.Agent{{ID: "a0", Name: "Strix", Status: "running"}}
+		m.snapshot.Vulnerabilities = []map[string]any{{"title": "XSS", "severity": "high"}}
+		m.focus = focus
+		m.resizeViewport()
+		return m.sidebarView(26, m.height)
+	}
+	idle := borderColorsOf(focusInput)
+	if strings.Contains(idle, "34;197;94") {
+		t.Fatal("an unfocused sidebar panel drew a green border")
+	}
+	for _, focus := range []focusMode{focusAgents, focusVulnerabilities} {
+		if !strings.Contains(borderColorsOf(focus), "34;197;94") {
+			t.Fatalf("focus %v did not draw a green border", focus)
+		}
+	}
+}
+
+// A wrapped exception is several lines. The log budgets rows by entry, so it has
+// to become one row or the launch column grows past the terminal.
+func TestSetupLogKeepsMultiLineErrorsToOneRow(t *testing.T) {
+	model := New(nil)
+	model.width, model.height = 100, 26
+	model.showSplash = false
+	model.handleEnvelope(stateEnvelope(t, 1, protocol.Snapshot{SetupMode: true, ScanState: "setup"}))
+	model.setupMsg("boom\nTraceback (most recent call last):\n  File \"x.py\", line 1\n    raise", render.Col(red))
+	model.resizeViewport()
+
+	if entries := len(model.setupLog); entries != 1 {
+		t.Fatalf("one message became %d log entries", entries)
+	}
+	if strings.Contains(model.setupLog[0], "\n") {
+		t.Fatalf("log entry spans rows: %q", model.setupLog[0])
+	}
+	lines := strings.Split(model.View(), "\n")
+	if len(lines) > model.height {
+		t.Fatalf("start screen is %d rows in a %d-row terminal", len(lines), model.height)
+	}
+}
@@ -0,0 +1,292 @@
+package app
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/protocol"
+)
+
+// lastIndex returns the index of the last command of the given type, or -1.
+func lastIndex(types []string, want string) int {
+	last := -1
+	for i, value := range types {
+		if value == want {
+			last = i
+		}
+	}
+	return last
+}
+
+// firstIndex returns the index of the first command of the given type, or -1.
+func firstIndex(types []string, want string) int {
+	for i, value := range types {
+		if value == want {
+			return i
+		}
+	}
+	return -1
+}
+
+// drainCommands runs a (possibly batched) command and decodes every protocol
+// frame the sends wrote to the connection, in order.
+func drainCommands(t *testing.T, cmd tea.Cmd, connection *recordingConn) []protocol.Envelope {
+	t.Helper()
+	if cmd == nil {
+		return nil
+	}
+	var run func(tea.Cmd)
+	run = func(c tea.Cmd) {
+		if c == nil {
+			return
+		}
+		msg := c()
+		switch typed := msg.(type) {
+		case tea.BatchMsg:
+			for _, sub := range typed {
+				run(sub)
+			}
+		case sentMsg:
+			if typed.err != nil {
+				t.Fatalf("command failed: %#v", typed)
+			}
+		default:
+			// tea.Sequence yields an unexported sequenceMsg ([]tea.Cmd); run its
+			// commands in order, which is the ordering the sequence guarantees.
+			if value := reflect.ValueOf(msg); value.Kind() == reflect.Slice {
+				for i := 0; i < value.Len(); i++ {
+					if sub, ok := value.Index(i).Interface().(tea.Cmd); ok {
+						run(sub)
+					}
+				}
+			}
+		}
+	}
+	run(cmd)
+
+	var envelopes []protocol.Envelope
+	raw := connection.Bytes()
+	for len(raw) >= 4 {
+		size := int(binary.BigEndian.Uint32(raw[:4]))
+		if len(raw) < size+4 {
+			t.Fatalf("truncated command frame")
+		}
+		var envelope protocol.Envelope
+		if err := json.Unmarshal(raw[4:size+4], &envelope); err != nil {
+			t.Fatal(err)
+		}
+		envelopes = append(envelopes, envelope)
+		raw = raw[size+4:]
+	}
+	return envelopes
+}
+
+func commandTypes(envelopes []protocol.Envelope) []string {
+	types := make([]string, len(envelopes))
+	for i, envelope := range envelopes {
+		types[i] = envelope.Type
+	}
+	return types
+}
+
+// startVerify returns the verify flag on the setup.start command, and whether
+// a setup.start command was present at all.
+func startVerify(t *testing.T, envelopes []protocol.Envelope) (verify, found bool) {
+	t.Helper()
+	for _, envelope := range envelopes {
+		if envelope.Type != "setup.start" {
+			continue
+		}
+		var payload struct {
+			Verify bool `json:"verify"`
+		}
+		if err := json.Unmarshal(envelope.Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		return payload.Verify, true
+	}
+	return false, false
+}
+
+func contains(values []string, want string) bool {
+	for _, value := range values {
+		if value == want {
+			return true
+		}
+	}
+	return false
+}
+
+// startPayloadFlag reports a boolean field on the setup.start command.
+func startPayloadFlag(t *testing.T, envelopes []protocol.Envelope, field string) (value, found bool) {
+	t.Helper()
+	for _, envelope := range envelopes {
+		if envelope.Type != "setup.start" {
+			continue
+		}
+		var payload map[string]any
+		if err := json.Unmarshal(envelope.Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		flag, ok := payload[field].(bool)
+		return flag, ok
+	}
+	return false, false
+}
+
+// A bare prompt launches straight away, asking to mount the working directory
+// rather than adding it as a target. The prompt is held in case it is declined.
+func TestSetupPromptWithoutTargetLaunchesAndRequestsMount(t *testing.T) {
+	connection := &recordingConn{}
+	model := New(&Client{conn: connection})
+	model.snapshot = protocol.Snapshot{SetupMode: true, WorkingDir: "/Users/me/code/api"}
+
+	updated, cmd := model.submit("find auth bugs in the login flow")
+	model = updated.(Model)
+	envelopes := drainCommands(t, cmd, connection)
+	types := commandTypes(envelopes)
+
+	if !contains(types, "setup.set_instruction") || !contains(types, "setup.start") {
+		t.Fatalf("bare prompt did not launch: %v", types)
+	}
+	if contains(types, "setup.add_target") {
+		t.Fatalf("the working directory must not be added as a target: %v", types)
+	}
+	if mount, found := startPayloadFlag(t, envelopes, "mount_working_dir"); !found || !mount {
+		t.Fatalf("mount was not requested: mount_working_dir=%v found=%v", mount, found)
+	}
+	// A bare prompt launches optimistically: no model preflight.
+	if verify, found := startVerify(t, envelopes); !found || verify {
+		t.Fatalf("bare prompt should launch with verify=false, got verify=%v found=%v", verify, found)
+	}
+	// setup.start leaves setup mode, so it must be the last command sent.
+	if start, instr := firstIndex(types, "setup.start"), lastIndex(types, "setup.set_instruction"); start < instr {
+		t.Fatalf("setup.start (%d) must come after setup.set_instruction (%d): %v", start, instr, types)
+	}
+	if model.pendingPrompt != "find auth bugs in the login flow" {
+		t.Fatalf("prompt was not held in case the mount is declined: %q", model.pendingPrompt)
+	}
+	// The confirmation is not raised locally; the backend asks for it.
+	if model.modal != modalNone {
+		t.Fatalf("submit should not open a dialog itself: modal=%v", model.modal)
+	}
+}
+
+// The backend asks from the live view, so the prompt follows the snapshot.
+func TestPendingMountOpensAndClosesWithTheSnapshot(t *testing.T) {
+	model := New(nil)
+	model.width, model.height = 130, 40
+	model.ready = true
+
+	model.snapshot.PendingMount = "/Users/me/code/api"
+	model.syncMountPrompt()
+	if model.modal != modalConfirmMount {
+		t.Fatalf("pending mount did not raise the prompt: modal=%v", model.modal)
+	}
+	if model.modalChoice != 1 {
+		t.Fatalf("a consent prompt should default to declining, got %d", model.modalChoice)
+	}
+	// It names the directory the backend is waiting on, and stays compact.
+	view := ansi.Strip(model.mountConfirmView())
+	if !strings.Contains(view, "/Users/me/code/api") {
+		t.Fatalf("prompt does not name the directory: %s", view)
+	}
+	if rows := strings.Count(view, "\n") + 1; rows > 6 {
+		t.Fatalf("corner prompt should stay compact, got %d rows:\n%s", rows, view)
+	}
+
+	// Once the backend has the answer it clears, which closes the prompt.
+	model.snapshot.PendingMount = ""
+	model.syncMountPrompt()
+	if model.modal != modalNone {
+		t.Fatalf("prompt stayed open after the pending mount cleared: %v", model.modal)
+	}
+}
+
+// Answering replies to the backend; declining puts the prompt back to edit.
+func TestMountConfirmationAnswers(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		key      tea.KeyMsg
+		choice   int
+		approved bool
+	}{
+		{"confirm", tea.KeyMsg{Type: tea.KeyEnter}, 0, true},
+		{"cancel", tea.KeyMsg{Type: tea.KeyEnter}, 1, false},
+		{"escape", tea.KeyMsg{Type: tea.KeyEsc}, 1, false},
+	} {
+		connection := &recordingConn{}
+		model := New(&Client{conn: connection})
+		model.width, model.height = 130, 40
+		model.snapshot = protocol.Snapshot{SetupMode: true, WorkingDir: "/Users/me/code/api"}
+		updated, _ := model.submit("find auth bugs in the login flow")
+		model = updated.(Model)
+		connection.Reset()
+		model.snapshot.PendingMount = "/Users/me/code/api"
+		model.syncMountPrompt()
+		model.modalChoice = tc.choice
+
+		updated, cmd := model.updateModal(tc.key)
+		model = updated.(Model)
+		envelopes := drainCommands(t, cmd, connection)
+
+		if len(envelopes) != 1 || envelopes[0].Type != "setup.confirm_mount" {
+			t.Fatalf("%s: expected one setup.confirm_mount, got %v", tc.name, commandTypes(envelopes))
+		}
+		var payload struct {
+			Approved bool `json:"approved"`
+		}
+		if err := json.Unmarshal(envelopes[0].Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload.Approved != tc.approved {
+			t.Fatalf("%s: approved=%v, want %v", tc.name, payload.Approved, tc.approved)
+		}
+		// Declining returns to the start screen, so the prompt comes back.
+		want := ""
+		if !tc.approved {
+			want = "find auth bugs in the login flow"
+		}
+		if got := model.input.Value(); got != want {
+			t.Fatalf("%s: composer = %q, want %q", tc.name, got, want)
+		}
+		if model.pendingPrompt != "" {
+			t.Fatalf("%s: held prompt was not cleared: %q", tc.name, model.pendingPrompt)
+		}
+	}
+}
+
+// A prompt that names a target adds it and launches.
+func TestSetupPromptWithTargetLaunches(t *testing.T) {
+	connection := &recordingConn{}
+	model := New(&Client{conn: connection})
+	model.snapshot = protocol.Snapshot{SetupMode: true}
+
+	_, cmd := model.submit("https://juice-shop.example.com hit the coupon endpoint")
+	envelopes := drainCommands(t, cmd, connection)
+	types := commandTypes(envelopes)
+
+	for _, want := range []string{"setup.add_target", "setup.set_instruction", "setup.start"} {
+		if !contains(types, want) {
+			t.Fatalf("missing %s in %v", want, types)
+		}
+	}
+	// A named target keeps the upfront model check.
+	if verify, found := startVerify(t, envelopes); !found || !verify {
+		t.Fatalf("targeted prompt should launch with verify=true, got verify=%v found=%v", verify, found)
+	}
+	// The target and instruction must reach the backend before setup.start
+	// closes the setup guard.
+	start := firstIndex(types, "setup.start")
+	if target := lastIndex(types, "setup.add_target"); start < target {
+		t.Fatalf("setup.start (%d) must come after setup.add_target (%d): %v", start, target, types)
+	}
+	if instr := lastIndex(types, "setup.set_instruction"); start < instr {
+		t.Fatalf("setup.start (%d) must come after setup.set_instruction (%d): %v", start, instr, types)
+	}
+}
@@ -0,0 +1,647 @@
+package app
+
+import (
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+)
+
+func (m Model) updateMain(key tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch key.String() {
+	case "f1":
+		m.openModal(modalHelp)
+		return m, nil
+	case "ctrl+c", "ctrl+q":
+		// Nothing to lose on the start screen; quit without confirmation.
+		if m.snapshot.SetupMode {
+			m.quitting = true
+			return m, tea.Batch(send(m.client, "app.quit", map[string]any{}), tea.Quit)
+		}
+		m.modalChoice = 1
+		m.openModal(modalQuit)
+		return m, nil
+	case "ctrl+o":
+		return m, send(m.client, "viewer.open", map[string]any{})
+	case "tab":
+		m.cycleFocus(1)
+		return m, nil
+	case "shift+tab":
+		m.cycleFocus(-1)
+		return m, nil
+	case "esc":
+		if !m.snapshot.SetupMode && m.selectedAgentCanStop() {
+			m.modalChoice = 1
+			m.openModal(modalStop)
+		}
+		return m, nil
+	case "up", "down":
+		if m.focus == focusAgents && len(m.snapshot.Agents) > 0 {
+			delta := 1
+			if key.String() == "up" {
+				delta = -1
+			}
+			entries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+			row := selectedAgentRow(entries, m.selectedAgent)
+			row = max(0, min(len(entries)-1, row+delta))
+			m.selectedAgent = entries[row].index
+			m.ensureAgentVisible()
+			m.refreshViewport()
+			return m, nil
+		}
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			delta := 1
+			if key.String() == "up" {
+				delta = -1
+			}
+			m.moveVulnerabilitySelection(delta)
+			m.ensureVulnerabilityVisible()
+			return m, nil
+		}
+	case "enter", " ":
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			if key.String() == "enter" {
+				m.openModal(modalVulnerability)
+				return m, nil
+			}
+		}
+		if m.focus == focusAgents {
+			if m.selectedAgent < len(m.snapshot.Agents) {
+				agentID := m.snapshot.Agents[m.selectedAgent].ID
+				if hasAgentChildren(agentID, m.snapshot.Agents) {
+					if m.collapsedAgents == nil {
+						m.collapsedAgents = map[string]bool{}
+					}
+					m.collapsedAgents[agentID] = !m.collapsedAgents[agentID]
+					m.ensureAgentVisible()
+				}
+			}
+			return m, nil
+		}
+		if key.String() == "enter" && m.focus == focusInput {
+			value := strings.TrimSpace(m.input.Value())
+			m.input.SetValue("")
+			m.resizeViewport()
+			if value != "" {
+				return m.submit(value)
+			}
+			return m, nil
+		}
+	case "pgup":
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			m.moveVulnerabilitySelection(-m.vulnerabilityPageItems())
+			m.ensureVulnerabilityVisible()
+			return m, nil
+		}
+		m.focus = focusChat
+		m.input.Blur()
+		m.followOutput = false
+		m.viewport.HalfViewUp()
+		return m, nil
+	case "pgdown":
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			m.moveVulnerabilitySelection(m.vulnerabilityPageItems())
+			m.ensureVulnerabilityVisible()
+			return m, nil
+		}
+		m.focus = focusChat
+		m.input.Blur()
+		m.viewport.HalfViewDown()
+		return m, nil
+	case "home":
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			m.selectedVuln = 0
+			m.ensureVulnerabilityVisible()
+			return m, nil
+		}
+	case "end":
+		if m.focus == focusVulnerabilities && len(m.snapshot.Vulnerabilities) > 0 {
+			m.selectedVuln = len(m.snapshot.Vulnerabilities) - 1
+			m.ensureVulnerabilityVisible()
+			return m, nil
+		}
+		m.viewport.GotoBottom()
+		m.followOutput = true
+		return m, nil
+	}
+	if m.focus == focusChat {
+		var cmd tea.Cmd
+		m.viewport, cmd = m.viewport.Update(key)
+		return m, cmd
+	}
+	var cmd tea.Cmd
+	m.input, cmd = m.input.Update(key)
+	// Typing changes how far the composer wraps, so refit it.
+	m.resizeViewport()
+	return m, cmd
+}
+
+// updateMouse routes wheel and click events to the pane under the pointer.
+func (m Model) updateMouse(msg tea.MouseMsg) (tea.Model, tea.Cmd) {
+	if m.modal != modalNone {
+		return m.updateModalMouse(msg)
+	}
+	if m.snapshot.SetupMode {
+		return m.updateSetupMouse(msg)
+	}
+	showSidebar, _, chatWidth, chatHeight := m.layout()
+	viewerHeight := m.viewerHeight()
+	_, vulnHeight, agentHeight := m.sidebarHeights()
+	x, y := msg.X, msg.Y
+	if m.updateMainScrollbarMouse(
+		msg, showSidebar, chatWidth, chatHeight, viewerHeight, agentHeight, vulnHeight,
+	) {
+		return m, nil
+	}
+	if m.selection.dragging {
+		switch msg.Action {
+		case tea.MouseActionMotion:
+			// Clamp to the owning pane so dragging past an edge keeps
+			// extending the selection.
+			if m.selection.region == regionInput {
+				top := m.inputTop()
+				cx := min(max(x, 2+inputPromptWidth), max(2+inputPromptWidth, chatWidth-2))
+				cy := min(max(y, top+1), top+m.input.Height())
+				if line, col, ok := m.inputContentCell(cx, cy); ok {
+					m.extendSelection(line, col)
+				}
+				return m, nil
+			}
+			traceHeight := chatHeight - 2
+			cx := min(max(x, 1), max(1, chatWidth-2))
+			cy := min(max(y, 1), max(1, traceHeight))
+			if line, col, ok := m.chatContentCell(cx, cy); ok {
+				m.extendSelection(line, col)
+			}
+			return m, nil
+		case tea.MouseActionRelease:
+			return m, m.finishSelection()
+		}
+	}
+	switch msg.Button {
+	case tea.MouseButtonWheelUp:
+		if showSidebar && x >= chatWidth+1 {
+			switch {
+			case y < viewerHeight:
+				return m, nil
+			case y < viewerHeight+agentHeight:
+				m.focus = focusAgents
+				m.input.Blur()
+				m.agentOffset = max(0, m.agentOffset-3)
+				m.keepAgentSelectionInWindow()
+				m.refreshViewport()
+			case vulnHeight > 0 && y < viewerHeight+agentHeight+vulnHeight:
+				m.focus = focusVulnerabilities
+				m.input.Blur()
+				m.vulnOffset = max(0, m.vulnOffset-3)
+				m.keepVulnerabilitySelectionInWindow()
+			}
+			return m, nil
+		}
+		m.focus = focusChat
+		m.input.Blur()
+		m.followOutput = false
+		m.viewport.LineUp(3)
+		return m, nil
+	case tea.MouseButtonWheelDown:
+		if showSidebar && x >= chatWidth+1 {
+			switch {
+			case y < viewerHeight:
+				return m, nil
+			case y < viewerHeight+agentHeight:
+				m.focus = focusAgents
+				m.input.Blur()
+				rows := m.agentPageSize()
+				m.agentOffset = min(max(0, len(agentTreeEntries(m.snapshot.Agents, m.collapsedAgents))-rows), m.agentOffset+3)
+				m.keepAgentSelectionInWindow()
+				m.refreshViewport()
+			case vulnHeight > 0 && y < viewerHeight+agentHeight+vulnHeight:
+				m.focus = focusVulnerabilities
+				m.input.Blur()
+				totalRows, _ := m.vulnerabilityScrollRows()
+				m.vulnOffset = min(max(0, totalRows-m.vulnerabilityPageSize()), m.vulnOffset+3)
+				m.keepVulnerabilitySelectionInWindow()
+			}
+			return m, nil
+		}
+		m.viewport.LineDown(3)
+		if m.viewport.AtBottom() {
+			m.followOutput = true
+		}
+		return m, nil
+	}
+	if msg.Action != tea.MouseActionPress || msg.Button != tea.MouseButtonLeft {
+		return m, nil
+	}
+	statusH := 0
+	if m.statusVisible() {
+		statusH = 1
+	}
+	inputTop := chatHeight + statusH
+	// Chat column: chat box on top, input box below the (optional) status row.
+	if x < chatWidth {
+		switch {
+		case y >= inputTop:
+			m.focus = focusInput
+			m.input.Focus()
+			if line, col, ok := m.inputContentCell(x, y); ok {
+				m.beginSelection(regionInput, line, col)
+			} else {
+				m.selection.active = false
+			}
+		case y < chatHeight:
+			m.focus = focusChat
+			m.input.Blur()
+			if line, col, ok := m.chatContentCell(x, y); ok {
+				m.beginSelection(regionChat, line, col)
+			} else {
+				m.selection.active = false
+			}
+		default:
+			m.selection.active = false
+		}
+		return m, nil
+	}
+
+	if !showSidebar || x < chatWidth+1 {
+		return m, nil
+	}
+	// Sidebar: viewer, agents, vulnerabilities, then stats.
+	switch {
+	case y < viewerHeight:
+		return m, send(m.client, "viewer.open", map[string]any{})
+	case y < viewerHeight+agentHeight:
+		m.focus = focusAgents
+		m.input.Blur()
+		// Content starts after the top border (1) and vertical padding (1).
+		entries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+		start := windowStart(m.agentOffset, len(entries), max(1, agentHeight-4))
+		localY := y - viewerHeight
+		if row := start + localY - 2; localY >= 2 && localY < agentHeight-2 && row < len(entries) {
+			m.selectedAgent = entries[row].index
+			agentID := m.snapshot.Agents[m.selectedAgent].ID
+			if hasAgentChildren(agentID, m.snapshot.Agents) {
+				m.collapsedAgents[agentID] = !m.collapsedAgents[agentID]
+				m.ensureAgentVisible()
+			}
+			m.refreshViewport()
+		}
+	case vulnHeight > 0 && y < viewerHeight+agentHeight+vulnHeight:
+		m.focus = focusVulnerabilities
+		m.input.Blur()
+		// Content starts after the top border (1); clicking a row opens its detail.
+		row := y - viewerHeight - agentHeight - 1
+		if idx := m.vulnerabilityIndexAtRow(row); row >= 0 && row < vulnHeight-2 && idx >= 0 {
+			m.selectedVuln = idx
+			m.openModal(modalVulnerability)
+		}
+	}
+	return m, nil
+}
+
+func (m *Model) updateMainScrollbarMouse(
+	msg tea.MouseMsg,
+	showSidebar bool,
+	chatWidth, chatHeight, viewerHeight, agentHeight, vulnHeight int,
+) bool {
+	if msg.Action == tea.MouseActionRelease {
+		if m.draggingScrollbar == scrollbarNone {
+			return false
+		}
+		m.draggingScrollbar = scrollbarNone
+		return true
+	}
+	if msg.Action == tea.MouseActionMotion && m.draggingScrollbar != scrollbarNone {
+		m.scrollFromMouse(m.draggingScrollbar, msg.Y, chatHeight, viewerHeight, agentHeight)
+		return true
+	}
+	if msg.Action != tea.MouseActionPress || msg.Button != tea.MouseButtonLeft {
+		return false
+	}
+	target := m.scrollbarAt(msg, showSidebar, chatWidth, chatHeight, viewerHeight, agentHeight, vulnHeight)
+	if target == scrollbarNone {
+		return false
+	}
+	m.draggingScrollbar = target
+	m.scrollFromMouse(target, msg.Y, chatHeight, viewerHeight, agentHeight)
+	return true
+}
+
+// scrollbarGrab is how far either side of the bar still counts as grabbing it. A
+// one column target is unreasonable to hit with a mouse, and nothing else lives
+// in the column beside it.
+const scrollbarGrab = 1
+
+func nearColumn(x, column int) bool {
+	return x >= column-scrollbarGrab && x <= column+scrollbarGrab
+}
+
+// scrollbarAt reports which scrollbar, if any, the pointer is over.
+func (m Model) scrollbarAt(
+	msg tea.MouseMsg,
+	showSidebar bool,
+	chatWidth, chatHeight, viewerHeight, agentHeight, vulnHeight int,
+) scrollbarTarget {
+	switch {
+	case nearColumn(msg.X, chatWidth-2) && msg.Y >= 1 && msg.Y < chatHeight-1 &&
+		m.viewport.TotalLineCount() > m.viewport.VisibleLineCount():
+		return scrollbarTrace
+	case showSidebar && nearColumn(msg.X, m.width-3) && msg.Y >= viewerHeight+2 &&
+		msg.Y < viewerHeight+agentHeight-2 &&
+		len(agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)) > m.agentPageSize():
+		return scrollbarAgents
+	case showSidebar && vulnHeight > 0 && nearColumn(msg.X, m.width-3) &&
+		msg.Y >= viewerHeight+agentHeight+1 &&
+		msg.Y < viewerHeight+agentHeight+vulnHeight-1:
+		totalRows, _ := m.vulnerabilityScrollRows()
+		if totalRows > m.vulnerabilityPageSize() {
+			return scrollbarFindings
+		}
+	}
+	return scrollbarNone
+}
+
+func (m *Model) scrollFromMouse(
+	target scrollbarTarget,
+	y, chatHeight, viewerHeight, agentHeight int,
+) {
+	switch target {
+	case scrollbarTrace:
+		height := max(1, chatHeight-2)
+		offset := scrollbarOffset(y-1, height, m.viewport.TotalLineCount(), m.viewport.VisibleLineCount())
+		m.focus = focusChat
+		m.input.Blur()
+		m.viewport.SetYOffset(offset)
+		m.followOutput = m.viewport.AtBottom()
+	case scrollbarAgents:
+		height := m.agentPageSize()
+		total := len(agentTreeEntries(m.snapshot.Agents, m.collapsedAgents))
+		m.focus = focusAgents
+		m.input.Blur()
+		m.agentOffset = scrollbarOffset(y-viewerHeight-2, height, total, height)
+		m.keepAgentSelectionInWindow()
+		m.refreshViewport()
+	case scrollbarFindings:
+		height := m.vulnerabilityPageSize()
+		totalRows, _ := m.vulnerabilityScrollRows()
+		m.focus = focusVulnerabilities
+		m.input.Blur()
+		// The offset is a row, so dragging moves the list continuously.
+		m.vulnOffset = scrollbarOffset(y-viewerHeight-agentHeight-1, height, totalRows, height)
+		m.keepVulnerabilitySelectionInWindow()
+	}
+}
+
+func scrollbarOffset(row, height, total, visible int) int {
+	maxOffset := max(0, total-visible)
+	if height <= 1 || maxOffset == 0 {
+		return 0
+	}
+	return maxOffset * min(max(0, row), height-1) / (height - 1)
+}
+
+func (m Model) updateSetupMouse(msg tea.MouseMsg) (tea.Model, tea.Cmd) {
+	switch msg.Button {
+	case tea.MouseButtonWheelUp:
+		m.focus = focusChat
+		m.input.Blur()
+		m.followOutput = false
+		m.viewport.LineUp(3)
+		return m, nil
+	case tea.MouseButtonWheelDown:
+		m.viewport.LineDown(3)
+		if m.viewport.AtBottom() {
+			m.followOutput = true
+		}
+		return m, nil
+	}
+	if msg.Action == tea.MouseActionPress && msg.Button == tea.MouseButtonLeft {
+		m.focus = focusInput
+		m.input.Focus()
+	}
+	return m, nil
+}
+
+// pressReportButton performs a button of the report row, however it was reached.
+func (m Model) pressReportButton(button string) (tea.Model, tea.Cmd) {
+	switch button {
+	case reportPrev:
+		m.showVulnerability(m.selectedVuln - 1)
+	case reportNext:
+		m.showVulnerability(m.selectedVuln + 1)
+	case reportCopy:
+		m.reportFocus = reportCopy
+		return m, m.startVulnerabilityCopy()
+	default:
+		m.closeModal()
+	}
+	return m, nil
+}
+
+func (m Model) updateModalMouse(msg tea.MouseMsg) (tea.Model, tea.Cmd) {
+	if m.modal == modalVulnerability {
+		view := m.modalView()
+		left, top, _, _ := m.centeredViewBounds(view)
+		viewportLeft := left + 4 // border and three-cell dialog padding
+		viewportTop := top + 3   // border and two-cell dialog padding
+		insideViewport := msg.X >= viewportLeft && msg.X < viewportLeft+m.vulnViewport.Width+2 &&
+			msg.Y >= viewportTop && msg.Y < viewportTop+m.vulnViewport.Height
+		switch msg.Button {
+		case tea.MouseButtonWheelUp:
+			if insideViewport {
+				m.vulnViewport.LineUp(3)
+			}
+			return m, nil
+		case tea.MouseButtonWheelDown:
+			if insideViewport {
+				m.vulnViewport.LineDown(3)
+			}
+			return m, nil
+		}
+	}
+	if msg.Action != tea.MouseActionPress || msg.Button != tea.MouseButtonLeft {
+		return m, nil
+	}
+	view := m.modalView()
+	switch m.modal {
+	case modalQuit, modalStop:
+		if m.centeredLabelHit(view, "Yes", msg.X, msg.Y) {
+			m.modalChoice = 0
+			return m.updateModal(tea.KeyMsg{Type: tea.KeyEnter})
+		}
+		if m.centeredLabelHit(view, "No", msg.X, msg.Y) {
+			m.modalChoice = 1
+			return m.updateModal(tea.KeyMsg{Type: tea.KeyEnter})
+		}
+	case modalVulnerability:
+		for _, button := range m.reportButtons() {
+			if button == reportCopy || button == reportDone {
+				continue
+			}
+			if m.centeredLabelHit(view, button, msg.X, msg.Y) {
+				m.reportFocus = button
+				return m.pressReportButton(button)
+			}
+		}
+		if m.centeredLabelHit(view, "Copy", msg.X, msg.Y) {
+			m.reportFocus = reportCopy
+			cmd := m.startVulnerabilityCopy()
+			return m, cmd
+		}
+		if m.centeredLabelHit(view, "Done", msg.X, msg.Y) {
+			m.reportFocus = reportDone
+			m.closeModal()
+		}
+	}
+	return m, nil
+}
+
+func (m Model) centeredViewBounds(view string) (left, top, width, height int) {
+	width = lipgloss.Width(view)
+	height = strings.Count(view, "\n") + 1
+	left = max(0, (m.width-width)/2)
+	top = max(0, (m.height-height)/2)
+	return
+}
+
+func (m Model) centeredLabelHit(view, label string, x, y int) bool {
+	left, top, _, _ := m.centeredViewBounds(view)
+	for row, line := range strings.Split(view, "\n") {
+		plain := ansi.Strip(line)
+		index := strings.Index(plain, label)
+		if index < 0 || y != top+row {
+			continue
+		}
+		start := left + ansi.StringWidth(plain[:index])
+		return x >= start-1 && x < start+ansi.StringWidth(label)+1
+	}
+	return false
+}
+
+func (m *Model) cycleFocus(delta int) {
+	available := []focusMode{focusInput, focusChat}
+	if m.width >= 120 {
+		available = append(available, focusAgents)
+		if len(m.snapshot.Vulnerabilities) > 0 {
+			available = append(available, focusVulnerabilities)
+		}
+	}
+	idx := 0
+	for i, focus := range available {
+		if focus == m.focus {
+			idx = i
+		}
+	}
+	m.focus = available[clampCycle(idx+delta, len(available))]
+	if m.focus == focusInput {
+		m.input.Focus()
+	} else {
+		m.input.Blur()
+	}
+}
+
+func clampCycle(value, length int) int {
+	if length <= 0 {
+		return 0
+	}
+	return (value%length + length) % length
+}
+
+func (m Model) updateModal(key tea.KeyMsg) (tea.Model, tea.Cmd) {
+	if m.modal == modalHelp {
+		if key.String() != "" {
+			m.closeModal()
+		}
+		return m, nil
+	}
+	if m.modal == modalVulnerability {
+		switch key.String() {
+		case "esc":
+			m.closeModal()
+		// The arrows step between reports directly; tab walks the button row.
+		case "left":
+			m.showVulnerability(m.selectedVuln - 1)
+		case "right":
+			m.showVulnerability(m.selectedVuln + 1)
+		case "tab":
+			m.stepReportFocus(1)
+		case "shift+tab":
+			m.stepReportFocus(-1)
+		case "enter":
+			return m.pressReportButton(m.focusedReportButton())
+		case "c":
+			m.reportFocus = reportCopy
+			cmd := m.startVulnerabilityCopy()
+			return m, cmd
+		case "up":
+			m.vulnViewport.LineUp(1)
+		case "down":
+			m.vulnViewport.LineDown(1)
+		case "pgup":
+			m.vulnViewport.HalfViewUp()
+		case "pgdown":
+			m.vulnViewport.HalfViewDown()
+		case "home":
+			m.vulnViewport.GotoTop()
+		case "end":
+			m.vulnViewport.GotoBottom()
+		}
+		return m, nil
+	}
+	switch key.String() {
+	case "esc":
+		if m.modal == modalConfirmMount {
+			// The backend is waiting on an answer; escape declines it.
+			return m, m.answerMountConfirmation(false)
+		}
+		m.closeModal()
+		return m, nil
+	case "left", "right", "up", "down", "tab":
+		m.modalChoice = 1 - m.modalChoice
+		return m, nil
+	case "enter":
+		modal, choice := m.modal, m.modalChoice
+		if modal == modalConfirmMount {
+			// The snapshot closes this prompt once the backend has the answer.
+			return m, m.answerMountConfirmation(choice == 0)
+		}
+		m.closeModal()
+		if choice == 1 {
+			return m, nil
+		}
+		if modal == modalQuit {
+			m.quitting = true
+			return m, tea.Batch(send(m.client, "app.quit", map[string]any{}), tea.Quit)
+		}
+		if modal == modalStop && m.selectedAgentCanStop() {
+			agent := m.snapshot.Agents[m.selectedAgent]
+			return m, send(m.client, "agent.stop", map[string]any{"agent_id": agent.ID})
+		}
+	}
+	return m, nil
+}
+
+func (m *Model) openModal(mode modalMode) {
+	m.modal = mode
+	m.input.Blur()
+	if mode == modalConfirmMount {
+		// A consent prompt defaults to declining.
+		m.modalChoice = 1
+	}
+	if mode == modalVulnerability {
+		m.reportFocus = reportDone
+		m.modalChoice = 1
+		m.vulnerabilityCopied = false
+		m.vulnerabilityCopyError = ""
+		m.resizeVulnerabilityViewport()
+		m.vulnViewport.GotoTop()
+	}
+}
+
+func (m *Model) closeModal() {
+	m.modal = modalNone
+	if m.focus == focusInput {
+		m.input.Focus()
+	}
+}
@@ -0,0 +1,824 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/protocol"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+// eventSpan records which content lines of the chat trace belong to an
+// expandable tool event, so clicks can toggle its collapsed state.
+type eventSpan struct {
+	start, end int
+	eventID    string
+}
+
+// renderedBlock is a chat block kept across frames: rendering (syntax
+// highlighting, image placements, wrapping) is expensive and only changes
+// when the event, the chat width, or its expanded state changes.
+type renderedBlock struct {
+	version    int
+	width      int
+	expanded   bool
+	wrapped    string
+	expandable bool
+	height     int
+}
+
+func (m *Model) renderEvent(event protocol.Event, width int) renderedBlock {
+	expanded := m.expandedEvents[event.ID]
+	if cached, ok := m.blockCache[event.ID]; ok &&
+		cached.version == event.Version && cached.width == width && cached.expanded == expanded {
+		return cached
+	}
+	var block string
+	expandable := false
+	switch event.Type {
+	case "chat":
+		block = render.Chat(event.Data)
+	case "tool":
+		name := render.StringValue(event.Data["tool_name"])
+		block, expandable = render.CollapseTool(render.Tool(event.Data), name, expanded)
+	}
+	entry := renderedBlock{version: event.Version, width: width, expanded: expanded, expandable: expandable}
+	if block != "" {
+		entry.wrapped = wrapBlock(block, width)
+		entry.height = strings.Count(entry.wrapped, "\n") + 1
+	}
+	if m.blockCache == nil {
+		m.blockCache = map[string]renderedBlock{}
+	}
+	m.blockCache[event.ID] = entry
+	return entry
+}
+
+func (m *Model) chatContent() string {
+	if len(m.snapshot.Agents) == 0 {
+		switch m.snapshot.ScanState {
+		case "failed":
+			message := "Scan failed"
+			if m.snapshot.Error != nil && strings.TrimSpace(*m.snapshot.Error) != "" {
+				detail := strings.ReplaceAll(strings.TrimSpace(*m.snapshot.Error), "\n", " ")
+				message += "\n\n" + ansi.Truncate(detail, max(1, m.viewport.Width-4), "...")
+			}
+			return centeredPlaceholder(message, m.viewport.Width, m.viewport.Height)
+		case "stopped":
+			return centeredPlaceholder("Scan stopped", m.viewport.Width, m.viewport.Height)
+		case "completed":
+			return centeredPlaceholder("Scan completed", m.viewport.Width, m.viewport.Height)
+		case "preparing":
+			return centeredPlaceholder("Preparing scan...", m.viewport.Width, m.viewport.Height)
+		default:
+			return centeredPlaceholder("Loading...", m.viewport.Width, m.viewport.Height)
+		}
+	}
+	if m.selectedAgent >= len(m.snapshot.Agents) {
+		return ""
+	}
+	agentID := m.snapshot.Agents[m.selectedAgent].ID
+	events := append([]protocol.Event(nil), m.snapshot.Events...)
+	// Match _gather_agent_events: sort by (timestamp, id).
+	sort.SliceStable(events, func(i, j int) bool {
+		if events[i].Timestamp != events[j].Timestamp {
+			return events[i].Timestamp < events[j].Timestamp
+		}
+		return events[i].ID < events[j].ID
+	})
+	// .chat-content has padding: 0 1 — one column of horizontal padding, so wrap
+	// to width-2 and indent every line by one cell.
+	contentWidth := max(1, m.viewport.Width-2)
+	render.SetImageWidth(contentWidth - 2)
+	var blocks []string
+	var spans []eventSpan
+	line := 0
+	for _, event := range events {
+		if event.AgentID != agentID {
+			continue
+		}
+		entry := m.renderEvent(event, contentWidth)
+		if entry.wrapped == "" {
+			continue
+		}
+		if len(blocks) > 0 {
+			line++ // blank separator line between blocks
+		}
+		if entry.expandable {
+			spans = append(spans, eventSpan{start: line, end: line + entry.height - 1, eventID: event.ID})
+		}
+		line += entry.height
+		blocks = append(blocks, entry.wrapped)
+	}
+	m.eventSpans = spans
+	if len(blocks) == 0 {
+		return centeredPlaceholder("Starting agent...", m.viewport.Width, m.viewport.Height)
+	}
+	return indentLines(strings.Join(blocks, "\n\n"), " ")
+}
+
+// indentLines prefixes every line with the given pad (chat-content padding-left).
+func indentLines(s, pad string) string {
+	lines := strings.Split(s, "\n")
+	for i, line := range lines {
+		lines[i] = pad + line
+	}
+	return strings.Join(lines, "\n")
+}
+
+func centeredPlaceholder(text string, width, height int) string {
+	return lipgloss.Place(width, height, lipgloss.Center, lipgloss.Center, lipgloss.NewStyle().Foreground(dim).Italic(true).Render(text))
+}
+
+// truncate clips to a display-cell width, honoring wide runes and ANSI styling.
+func truncate(value string, limit int) string {
+	if limit <= 0 {
+		return ""
+	}
+	if ansi.StringWidth(value) <= limit {
+		return value
+	}
+	return ansi.Truncate(value, limit, "…")
+}
+
+// wrapBlock hard-wraps each line of a rendered block to the given cell width so
+// content never spills past the chat border, matching Textual's word wrapping.
+func wrapBlock(value string, width int) string {
+	if width <= 0 {
+		return value
+	}
+	var out []string
+	for _, line := range strings.Split(value, "\n") {
+		if ansi.StringWidth(line) <= width {
+			out = append(out, line)
+			continue
+		}
+		out = append(out, strings.Split(ansi.Wrap(line, width, " -"), "\n")...)
+	}
+	return strings.Join(out, "\n")
+}
+
+// scrollbarThumb brightens the bar being dragged so the grab reads as taking
+// hold of it.
+func (m Model) scrollbarThumb(target scrollbarTarget) lipgloss.Color {
+	if m.draggingScrollbar == target {
+		return thumbActive
+	}
+	return thumbResting
+}
+
+func verticalScrollbar(height, total, visible, offset int, thumb lipgloss.Color) string {
+	if height <= 0 || total <= visible {
+		return ""
+	}
+	visible = min(max(1, visible), max(1, total))
+	total = max(visible, total)
+	thumbHeight := height
+	thumbStart := 0
+	if total > visible {
+		thumbHeight = max(1, height*visible/total)
+		maxOffset := total - visible
+		thumbStart = (height - thumbHeight) * min(max(0, offset), maxOffset) / maxOffset
+	}
+	thumbStyle := lipgloss.NewStyle().Foreground(thumb)
+	bar := make([]string, height)
+	for row := range bar {
+		bar[row] = " "
+		if row >= thumbStart && row < thumbStart+thumbHeight {
+			bar[row] = thumbStyle.Render("█")
+		}
+	}
+	return strings.Join(bar, "\n")
+}
+
+// withVerticalScrollbar reserves a single column for the bar, and only while the
+// panel actually overflows.
+func withVerticalScrollbar(
+	content string,
+	width, height, total, visible, offset int,
+	thumb lipgloss.Color,
+) string {
+	if total <= visible {
+		return fixedPanelBody(content, width, height)
+	}
+	body := fixedPanelBody(content, max(1, width-1), height)
+	bar := verticalScrollbar(height, total, visible, offset, thumb)
+	return lipgloss.JoinHorizontal(lipgloss.Top, body, bar)
+}
+
+func visibleContent(content string, offset, height int) string {
+	if height <= 0 || content == "" {
+		return ""
+	}
+	lines := strings.Split(content, "\n")
+	start := min(max(0, offset), len(lines))
+	end := min(len(lines), start+height)
+	return strings.Join(lines[start:end], "\n")
+}
+
+func fixedPanelBody(content string, width, height int) string {
+	lines := strings.Split(content, "\n")
+	body := make([]string, max(0, height))
+	for row := range body {
+		line := ""
+		if row < len(lines) {
+			line = ansi.Truncate(lines[row], max(1, width), "")
+		}
+		padding := strings.Repeat(" ", max(0, width-ansi.StringWidth(line)))
+		// End every source style before padding; otherwise inline-code and tool
+		// backgrounds can paint the empty space through to the panel border.
+		body[row] = line + "\x1b[0m" + blackBG + padding
+	}
+	return strings.Join(body, "\n")
+}
+
+func (m Model) View() string {
+	view := fillBackground(m.viewInner())
+	// Kitty graphics transmissions ride out of band: they carry no visible
+	// cells, so writing them directly keeps the Bubble Tea frame diff clean.
+	for _, seq := range render.DrainImageTransmissions() {
+		_, _ = os.Stdout.WriteString(seq)
+	}
+	return view
+}
+
+func (m Model) viewInner() string {
+	if m.showSplash {
+		return m.splashView()
+	}
+	if !m.ready {
+		return lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, lipgloss.NewStyle().Foreground(dim).Render("Connecting to Strix…"), lipgloss.WithWhitespaceBackground(black))
+	}
+	main := m.mainView()
+	if m.snapshot.SetupMode {
+		main = m.setupView()
+	}
+	if m.modal == modalConfirmMount {
+		// A corner prompt, not a dialog: it sits out of the way in the live view
+		// while the scan waits on the answer.
+		main = m.cornerOverlay(main, m.modalView())
+	} else if m.modal != modalNone {
+		// Only the vulnerability detail dims its backdrop (#000000 80%); Help,
+		// Quit and Stop are transparent.
+		main = m.overlay(main, m.modalView(), m.modal == modalVulnerability)
+	}
+	return m.toastOverlay(main)
+}
+
+// cornerOverlay splices a panel in directly above the composer, right-aligned
+// with it, leaving the rest of the view visible behind it.
+func (m Model) cornerOverlay(view, panel string) string {
+	if panel == "" {
+		return view
+	}
+	fg := strings.Split(panel, "\n")
+	bg := strings.Split(view, "\n")
+	panelWidth := lipgloss.Width(panel)
+	// Right edge of the chat column, so it lines up with the composer rather
+	// than covering the sidebar.
+	_, _, chatWidth, _ := m.layout()
+	left := max(0, min(chatWidth, m.width)-panelWidth)
+	// Bottom row sits just above the composer, clearing the status line so the
+	// scan state and quit hint stay readable.
+	statusH := 0
+	if m.statusVisible() {
+		statusH = 1
+	}
+	top := max(0, m.inputTop()-statusH-len(fg))
+	for row := top; row < min(len(bg), top+len(fg)); row++ {
+		fgLine := ansi.Truncate(fg[row-top], max(0, m.width-left), "")
+		rightStart := left + lipgloss.Width(fgLine)
+		leftPart := padToWidth(ansi.Truncate(bg[row], left, ""), left)
+		rightPart := ""
+		if lipgloss.Width(bg[row]) > rightStart {
+			rightPart = ansi.TruncateLeft(bg[row], rightStart, "")
+		}
+		bg[row] = leftPart + fgLine + rightPart
+	}
+	return strings.Join(bg, "\n")
+}
+
+// toastOverlay splices a transient notification into the bottom-right corner,
+// where Textual's notify() toasts appeared.
+func (m Model) toastOverlay(view string) string {
+	if m.toast == "" {
+		return view
+	}
+	box := lipgloss.NewStyle().
+		Border(lipgloss.RoundedBorder()).
+		BorderForeground(green).
+		Background(black).
+		Foreground(textColor).
+		Padding(0, 1).
+		Render(m.toast)
+	fg := strings.Split(box, "\n")
+	bg := strings.Split(view, "\n")
+	boxWidth := lipgloss.Width(box)
+	left := max(0, m.width-boxWidth-2)
+	top := max(0, m.height-len(fg)-1)
+	for row := top; row < min(len(bg), top+len(fg)); row++ {
+		fgLine := fg[row-top]
+		rightStart := left + boxWidth
+		leftPart := padToWidth(ansi.Truncate(bg[row], left, ""), left)
+		rightPart := ""
+		if lipgloss.Width(bg[row]) > rightStart {
+			rightPart = ansi.TruncateLeft(bg[row], rightStart, "")
+		}
+		bg[row] = leftPart + fgLine + rightPart
+	}
+	return strings.Join(bg, "\n")
+}
+
+// blackBG is the SGR that selects a solid black background.
+const blackBG = "\x1b[48;2;0;0;0m"
+
+// fillBackground paints the whole frame black like Textual's Screen background.
+// Bubble Tea has no screen compositor, so any cell the view does not explicitly
+// color shows the terminal's default background. lipgloss emits a full reset
+// (\x1b[0m) at the end of every styled span, which also clears the background, so
+// we reassert black after each reset (and at the start). Spans that set their own
+// background — inline code, selected rows, buttons — keep it, because their color
+// is emitted before the reset.
+func fillBackground(view string) string {
+	if view == "" {
+		return view
+	}
+	return blackBG + strings.ReplaceAll(view, "\x1b[0m", "\x1b[0m"+blackBG)
+}
+
+func (m Model) splashView() string {
+	shine := "Starting Strix Agent"
+	chars := []rune(shine)
+	pos := m.splashFrame % (len(chars) + 8)
+	var start strings.Builder
+	for i, char := range chars {
+		distance := i - pos
+		if distance < 0 {
+			distance = -distance
+		}
+		// Tiers match SplashScreen._build_start_line_text:
+		// bright_white / white / #a3a3a3 / #525252.
+		color := lipgloss.Color("#525252")
+		bold := false
+		switch {
+		case distance <= 1:
+			color, bold = brightWhite, true
+		case distance <= 3:
+			color, bold = white, true
+		case distance <= 5:
+			color = lipgloss.Color("#a3a3a3")
+		}
+		start.WriteString(lipgloss.NewStyle().Foreground(color).Bold(bold).Render(string(char)))
+	}
+	welcome := lipgloss.NewStyle().Bold(true).Foreground(white).Render("Welcome to ") +
+		lipgloss.NewStyle().Bold(true).Foreground(green).Render("Strix") +
+		lipgloss.NewStyle().Bold(true).Foreground(white).Render("!")
+	version := lipgloss.NewStyle().Foreground(white).Faint(true).Render("v" + appVersion)
+	tagline := lipgloss.NewStyle().Foreground(white).Faint(true).Render("Open-source AI hackers for your apps")
+	url := lipgloss.NewStyle().Bold(true).Foreground(green).Render("strix.ai")
+	// The wordmark is shared with the launch screen so the two read as one moment.
+	content := wordmark() + "\n\n" +
+		welcome + "\n" + version + "\n" + tagline + "\n\n" +
+		start.String() + "\n\n" + url
+	if warn := m.snapshot.ModelWarning; warn != "" {
+		content += "\n\n" + splashModelWarning(warn)
+	}
+	panel := lipgloss.NewStyle().Border(lipgloss.RoundedBorder()).BorderForeground(green).Padding(1, 6).Align(lipgloss.Center).Render(content)
+	// #splash_screen background is solid black.
+	return lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, panel,
+		lipgloss.WithWhitespaceBackground(black))
+}
+
+// splashModelWarning ports SplashScreen._build_model_warning_text.
+func splashModelWarning(model string) string {
+	yellow := lipgloss.Color("#eab308")
+	return lipgloss.NewStyle().Bold(true).Foreground(yellow).Render("⚠ ") +
+		lipgloss.NewStyle().Bold(true).Foreground(render.Cyan).Render(model) +
+		lipgloss.NewStyle().Foreground(yellow).Render(" is not a recommended frontier model - pentest quality could be degraded")
+}
+
+// chatPaneKey identifies everything the bordered trace depends on.
+type chatPaneKey struct {
+	offset        int
+	width, height int
+	border        lipgloss.Color
+	selection     selectionState
+}
+
+// chatPane memoizes the bordered trace: slicing, scrollbar padding and border
+// styling all re-measure every visible cell, which is costly when inline image
+// placeholders (a base rune plus two combining marks per cell) fill the pane,
+// and the trace is unchanged across most frames.
+var chatPane struct {
+	key     chatPaneKey
+	content string
+	out     string
+}
+
+func (m Model) renderChatPane(width, height int, border lipgloss.Color) string {
+	key := chatPaneKey{offset: m.viewport.YOffset, width: width, height: height, border: border, selection: m.selection}
+	if chatPane.out != "" && chatPane.key == key && chatPane.content == m.viewportContent {
+		return chatPane.out
+	}
+	trace := withVerticalScrollbar(
+		m.highlightSelection(visibleContent(m.viewportContent, m.viewport.YOffset, height), m.viewport.YOffset),
+		width,
+		height,
+		m.viewport.TotalLineCount(),
+		m.viewport.VisibleLineCount(),
+		m.viewport.YOffset,
+		m.scrollbarThumb(scrollbarTrace),
+	)
+	out := lipgloss.NewStyle().Width(width).Height(height).
+		Border(lipgloss.RoundedBorder()).BorderForeground(border).Render(trace)
+	chatPane.key, chatPane.content, chatPane.out = key, m.viewportContent, out
+	return out
+}
+
+func (m Model) mainView() string {
+	showSidebar, sidebarWidth, chatWidth, chatHeight := m.layout()
+	// Matches tui_styles.tcss: #chat_history border is near-black when idle and
+	// green on focus.
+	chatBorder := lipgloss.Color("#0a0a0a")
+	if m.focus == focusChat {
+		chatBorder = green
+	}
+	traceHeight := chatHeight - 2
+	chat := m.renderChatPane(chatWidth-2, traceHeight, chatBorder)
+
+	inputBorder := dark
+	if m.focus == focusInput {
+		inputBorder = green
+	}
+	input := lipgloss.NewStyle().Width(chatWidth - 2).Height(m.input.Height()).
+		Border(lipgloss.RoundedBorder()).BorderForeground(inputBorder).PaddingLeft(1).
+		Render(m.highlightInputSelection(m.input.View()))
+
+	// Chat column: chat history, optional status row, then input — all chat-width.
+	leftParts := []string{chat}
+	if m.statusVisible() {
+		leftParts = append(leftParts, m.statusView(chatWidth))
+	}
+	leftParts = append(leftParts, input)
+	leftColumn := strings.Join(leftParts, "\n")
+
+	body := leftColumn
+	if showSidebar {
+		body = lipgloss.JoinHorizontal(lipgloss.Top, leftColumn, " ", m.sidebarView(sidebarWidth, m.height))
+	}
+	return lipgloss.NewStyle().Background(black).Foreground(textColor).Render(body)
+}
+
+// Every panel that Tab can reach shows focus the way the chat and the composer
+// do, with a green border. The stylesheet asked for near-black on the tree
+// instead, through a Tree:focus rule that lost to the #agents_tree id selector
+// and so never applied - honoring it made the outline vanish on the one panel
+// that had just become active.
+func (m Model) sidebarView(width, height int) string {
+	// Stats box height fits its content (auto, max 15); vulns panel max-height 12.
+	statsBody := m.statsView()
+	statsHeight, vulnHeight, agentHeight := m.sidebarHeights()
+	agentBorder := dark
+	if m.focus == focusAgents {
+		agentBorder = green
+	}
+	// #agents_tree padding: 1 (all sides); interior lines = box - border - v.padding.
+	agentRows := max(1, agentHeight-4)
+	agentEntries := agentTreeEntries(m.snapshot.Agents, m.collapsedAgents)
+	agents := withVerticalScrollbar(
+		m.agentsView(max(1, width-5), agentRows),
+		width-4,
+		agentRows,
+		len(agentEntries),
+		agentRows,
+		m.agentOffset,
+		m.scrollbarThumb(scrollbarAgents),
+	)
+	parts := []string{
+		lipgloss.NewStyle().Width(width-2).Height(m.viewerHeight()-2).Border(lipgloss.RoundedBorder()).BorderForeground(dark).Padding(0, 1).Render(m.viewerView(width - 4)),
+		lipgloss.NewStyle().Width(width-2).Height(agentHeight-2).Border(lipgloss.RoundedBorder()).BorderForeground(agentBorder).Padding(1, 1).Render(agents),
+	}
+	if vulnHeight > 0 {
+		vulnBorder := dark
+		if m.focus == focusVulnerabilities {
+			vulnBorder = green
+		}
+		vulnRows := max(1, vulnHeight-2)
+		totalRows, offsetRows := m.vulnerabilityScrollRows()
+		findings := withVerticalScrollbar(
+			m.vulnerabilitiesView(m.vulnerabilityListWidth(), vulnRows),
+			width-4,
+			vulnRows,
+			totalRows,
+			vulnRows,
+			offsetRows,
+			m.scrollbarThumb(scrollbarFindings),
+		)
+		parts = append(parts, lipgloss.NewStyle().Width(width-2).Height(vulnRows).Border(lipgloss.RoundedBorder()).BorderForeground(vulnBorder).Padding(0, 1).Render(findings))
+	}
+	parts = append(parts, lipgloss.NewStyle().Width(width-2).Height(statsHeight-2).Border(lipgloss.RoundedBorder()).BorderForeground(dark).Padding(0, 1).Render(statsBody))
+	return strings.Join(parts, "\n")
+}
+
+func (m Model) sidebarHeights() (statsHeight, vulnHeight, agentHeight int) {
+	// Measure the stats panel the way its box will render it: a long model name
+	// wraps inside the sidebar, and counting only its newlines would size the
+	// box short and push the whole frame past the bottom of the terminal.
+	statsRows := lipgloss.Height(lipgloss.NewStyle().Width(m.viewerContentWidth()).Render(m.statsView()))
+	statsHeight = min(15, statsRows+2)
+	if len(m.snapshot.Vulnerabilities) > 0 {
+		vulnHeight = min(12, len(m.vulnerabilityRows(m.vulnerabilityListWidth()))+2)
+	}
+	agentHeight = max(3, m.height-m.viewerHeight()-statsHeight-vulnHeight)
+	return
+}
+
+func (m Model) viewerHeight() int {
+	return strings.Count(m.viewerView(m.viewerContentWidth()), "\n") + 3
+}
+
+func (m Model) viewerContentWidth() int {
+	_, sidebarWidth, _, _ := m.layout()
+	if sidebarWidth == 0 {
+		sidebarWidth = 24
+	}
+	return max(1, sidebarWidth-4)
+}
+
+func (m Model) viewerView(width int) string {
+	switch m.snapshot.ViewerStatus {
+	case "running":
+		status := lipgloss.NewStyle().Foreground(green).Render("● Viewer running")
+		if m.snapshot.ViewerURL != nil && strings.TrimSpace(*m.snapshot.ViewerURL) != "" {
+			url := wrapBlock(strings.TrimSpace(*m.snapshot.ViewerURL), width)
+			return status + "\n" + lipgloss.NewStyle().Foreground(dim).Render(url)
+		}
+		return status
+	case "unavailable":
+		return truncate(lipgloss.NewStyle().Foreground(amber).Render("Viewer UI not built"), width)
+	case "failed":
+		return truncate(lipgloss.NewStyle().Foreground(red).Render("Viewer failed to start"), width)
+	default:
+		return truncate(lipgloss.NewStyle().Foreground(textColor).Render("▶ Watch live in browser"), width)
+	}
+}
+
+func (m Model) statsView() string {
+	w := lipgloss.NewStyle().Foreground(white)
+	var b strings.Builder
+	if model := m.snapshot.Model; model != "" {
+		b.WriteString(w.Render(model))
+	}
+	if m.snapshot.Subscription {
+		if b.Len() > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString(lipgloss.NewStyle().Foreground(green).Render("ChatGPT subscription"))
+	}
+	total := numberValue(m.snapshot.Usage["total_tokens"])
+	if total > 0 {
+		if b.Len() > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString(w.Render(fmt.Sprintf("%s tokens", formatCount(total))))
+		if cost := floatValue(m.snapshot.Usage["cost"]); !m.snapshot.Subscription && cost > 0 {
+			b.WriteString(w.Render(fmt.Sprintf(" · $%.2f", cost)))
+		}
+	}
+	if caido := m.snapshot.CaidoURL; caido != "" {
+		if b.Len() > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString(lipgloss.NewStyle().Bold(true).Foreground(white).Render("Caido: ") + w.Render(caido))
+	}
+	if b.Len() > 0 {
+		b.WriteString("\n")
+	}
+	b.WriteString(w.Render("v" + appVersion))
+	return b.String()
+}
+
+func numberValue(value any) int64 {
+	switch v := value.(type) {
+	case float64:
+		return int64(v)
+	case int64:
+		return v
+	case int:
+		return int64(v)
+	case json.Number:
+		n, _ := v.Int64()
+		return n
+	}
+	return 0
+}
+func floatValue(value any) float64 {
+	switch v := value.(type) {
+	case float64:
+		return v
+	case int:
+		return float64(v)
+	case string:
+		n, _ := strconv.ParseFloat(v, 64)
+		return n
+	}
+	return 0
+}
+func formatCount(value int64) string {
+	if value >= 1_000_000 {
+		return fmt.Sprintf("%.1fM", float64(value)/1_000_000)
+	}
+	if value >= 1_000 {
+		return fmt.Sprintf("%.1fK", float64(value)/1_000)
+	}
+	return strconv.FormatInt(value, 10)
+}
+
+func (m Model) statusView(width int) string {
+	// Status text color mirrors #status_text (#a3a3a3); keymap hints use white
+	// keys and dim actions (keymap_styled). See _get_status_display_content.
+	left, right := "", ""
+	if len(m.snapshot.Agents) > 0 && !m.snapshot.SetupMode {
+		agent := m.snapshot.Agents[m.selectedAgent]
+		quitHint := lipgloss.NewStyle().Foreground(white).Render("ctrl-q") + lipgloss.NewStyle().Foreground(dim).Render(" ") + lipgloss.NewStyle().Foreground(dim).Render("quit")
+		switch agent.Status {
+		case "running":
+			if m.agentHasEvents(agent.ID) {
+				left = m.sweepView() + lipgloss.NewStyle().Foreground(white).Render("esc") + lipgloss.NewStyle().Foreground(dim).Render(" ") + lipgloss.NewStyle().Foreground(dim).Render("stop")
+			} else {
+				left = m.sweepView() + lipgloss.NewStyle().Foreground(white).Render("Initializing")
+			}
+			right = quitHint
+		case "waiting":
+			left = lipgloss.NewStyle().Foreground(dim).Render("Send message to resume")
+			if msg := agent.ErrorMessage; msg != "" {
+				left = statusMessage(msg, red, " · Send message to resume", width)
+			}
+		case "budget_paused":
+			left = lipgloss.NewStyle().Foreground(amber).Render("Budget limit reached") +
+				lipgloss.NewStyle().Foreground(dim).Render(" · Send a message to continue")
+			right = quitHint
+		case "completed":
+			left = lipgloss.NewStyle().Foreground(mid).Render("Agent completed")
+		case "stopped":
+			left = lipgloss.NewStyle().Foreground(mid).Render("Agent stopped")
+		case "failed", "crashed":
+			msg := agent.ErrorMessage
+			if msg == "" {
+				msg = "Agent failed"
+			}
+			left = statusMessage(msg, red, " · Send message to resume", width)
+		}
+	}
+	if m.errorText != "" {
+		left = statusMessage(m.errorText, red, "", width-lipgloss.Width(right))
+	}
+	return composeStatusRow(left, right, width)
+}
+
+// composeStatusRow lays the status text and the corner hint on one row exactly
+// width columns wide. A wider row would widen the whole chat column, because
+// JoinHorizontal pads every row of a block to its widest, which pushes the
+// sidebar off screen and wraps the frame.
+func composeStatusRow(left, right string, width int) string {
+	if width <= 0 {
+		return ""
+	}
+	const leading = 1 // the row is indented one column, like the panels above it
+	// A terminal can be narrower than the hint itself. Drop the hint rather than
+	// keep it at the cost of the status, which is the part carrying information;
+	// ctrl-q works whether or not the row has room to say so.
+	if lipgloss.Width(right) > 0 && width < lipgloss.Width(right)+leading+2 {
+		right = ""
+	}
+	separator := 0
+	if lipgloss.Width(right) > 0 {
+		separator = 1
+	}
+	left = truncate(left, max(0, width-leading-lipgloss.Width(right)-separator))
+	padding := max(0, width-leading-lipgloss.Width(left)-lipgloss.Width(right))
+	return " " + left + strings.Repeat(" ", padding) + right
+}
+
+// statusMessage fits a message and its trailing hint on the one status row. A
+// model or backend error can be a wrapped exception several lines long, so it is
+// flattened to a single line and clipped, leaving the hint readable.
+func statusMessage(message string, color lipgloss.Color, hint string, width int) string {
+	styledHint := lipgloss.NewStyle().Foreground(dim).Render(hint)
+	room := max(1, width-2-lipgloss.Width(styledHint))
+	flat := truncate(flattenStatus(message), room)
+	return lipgloss.NewStyle().Foreground(color).Render(flat) + styledHint
+}
+
+// flattenStatus turns a multi-line message into one line, collapsing the runs of
+// whitespace that joining its lines leaves behind.
+func flattenStatus(message string) string {
+	message = strings.NewReplacer("\r\n", " ", "\r", " ", "\n", " ", "\t", " ").Replace(message)
+	return strings.Join(strings.Fields(message), " ")
+}
+
+func (m Model) sweepView() string {
+	palette := []lipgloss.Color{
+		black, lipgloss.Color("#031a09"), lipgloss.Color("#052e16"), lipgloss.Color("#0d4a2a"),
+		lipgloss.Color("#15803d"), green, brightGreen, lipgloss.Color("#86efac"),
+	}
+	const numSquares = 6
+	numColors := len(palette)
+	offset := numColors - 1
+	maxPos := (numSquares - 1) + offset
+	totalRange := maxPos + offset
+	cycleLength := totalRange * 2
+	frameInCycle := m.sweepFrame % cycleLength
+	wavePos := totalRange - abs(totalRange-frameInCycle)
+	sweepPos := wavePos - offset
+
+	dotColor := lipgloss.Color("#0a3d1f")
+	var b strings.Builder
+	for i := 0; i < numSquares; i++ {
+		dist := abs(i - sweepPos)
+		colorIdx := numColors - 1 - dist
+		if colorIdx <= 0 {
+			b.WriteString(lipgloss.NewStyle().Foreground(dotColor).Render("·"))
+		} else {
+			b.WriteString(lipgloss.NewStyle().Foreground(palette[colorIdx]).Render("▪"))
+		}
+	}
+	b.WriteString(" ")
+	return b.String()
+}
+
+func abs(x int) int {
+	if x < 0 {
+		return -x
+	}
+	return x
+}
+
+func titleCase(s string) string {
+	return strings.Title(strings.ToLower(s))
+}
+
+// overlay composites a centered dialog on top of the live main view. When
+// dimmed is true (vulnerability detail, background: #000000 80%) the backdrop is
+// recolored to a dark grey; otherwise it is left untouched to match Textual's
+// transparent modal backdrop (background: $background 0%).
+func (m Model) overlay(background, foreground string, dimmed bool) string {
+	bg := strings.Split(background, "\n")
+	fg := strings.Split(foreground, "\n")
+	dialogHeight := len(fg)
+	dialogWidth := lipgloss.Width(foreground)
+	top := max(0, (m.height-dialogHeight)/2)
+	left := max(0, (m.width-dialogWidth)/2)
+	dimStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("#3f3f46"))
+	for row := 0; row < len(bg); row++ {
+		if row < top || row >= top+dialogHeight {
+			if dimmed {
+				bg[row] = dimStyle.Render(ansi.Strip(bg[row]))
+			}
+			continue
+		}
+		fgLine := fg[row-top]
+		rightStart := left + dialogWidth
+		var leftPart, rightPart string
+		if dimmed {
+			bgLine := ansi.Strip(bg[row])
+			leftPart = dimStyle.Render(truncateToWidth(bgLine, left))
+			if lipgloss.Width(bgLine) > rightStart {
+				rightPart = dimStyle.Render(ansi.TruncateLeft(bgLine, rightStart, ""))
+			}
+		} else {
+			// Preserve the original styling of the visible backdrop segments.
+			leftPart = padToWidth(ansi.Truncate(bg[row], left, ""), left)
+			if lipgloss.Width(bg[row]) > rightStart {
+				rightPart = ansi.TruncateLeft(bg[row], rightStart, "")
+			}
+		}
+		bg[row] = leftPart + fgLine + rightPart
+	}
+	return strings.Join(bg, "\n")
+}
+
+// padToWidth right-pads an ANSI string to an exact display width.
+func padToWidth(value string, width int) string {
+	w := lipgloss.Width(value)
+	if w >= width {
+		return value
+	}
+	return value + strings.Repeat(" ", width-w)
+}
+
+func truncateToWidth(value string, width int) string {
+	if width <= 0 {
+		return ""
+	}
+	if lipgloss.Width(value) <= width {
+		return value + strings.Repeat(" ", width-lipgloss.Width(value))
+	}
+	return ansi.Truncate(value, width, "")
+}
@@ -0,0 +1,178 @@
+package app
+
+// Markdown clipboard report for the vulnerability detail dialog, porting
+// VulnerabilityDetailScreen._get_markdown_report plus the report-writer fence
+// helpers (safe_fence, guess_language_name).
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/alecthomas/chroma/v2/lexers"
+
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+var backtickRun = regexp.MustCompile("`+")
+
+// safeFence returns a backtick fence that content cannot break out of: one
+// backtick longer than the longest run inside it, never fewer than three.
+func safeFence(content string) string {
+	longest := 0
+	for _, run := range backtickRun.FindAllString(content, -1) {
+		longest = max(longest, len(run))
+	}
+	return strings.Repeat("`", max(3, longest+1))
+}
+
+// guessLanguageName returns a markdown fence tag for code, defaulting to
+// "python" when auto-detection is inconclusive (legacy PoC scripts are Python).
+func guessLanguageName(code string) string {
+	lexer := lexers.Analyse(code)
+	if lexer == nil {
+		return "python"
+	}
+	config := lexer.Config()
+	if config == nil || len(config.Aliases) == 0 || config.Name == "plaintext" {
+		return "python"
+	}
+	return config.Aliases[0]
+}
+
+func titleCaseWords(text string) string {
+	words := strings.Fields(text)
+	for i, word := range words {
+		words[i] = titleCase(word)
+	}
+	return strings.Join(words, " ")
+}
+
+// vulnerabilityMarkdownReport builds the Markdown vulnerability report copied
+// to the clipboard, field-for-field with the old Textual screen.
+func vulnerabilityMarkdownReport(v map[string]any) string {
+	var lines []string
+
+	title := render.StringValue(v["title"])
+	if title == "" {
+		title = "Untitled Vulnerability"
+	}
+	lines = append(lines, "# "+title, "")
+
+	field := func(label, value string) {
+		if value != "" {
+			lines = append(lines, fmt.Sprintf("**%s:** %s", label, value))
+		}
+	}
+	field("ID", render.StringValue(v["id"]))
+	field("Severity", strings.ToUpper(render.StringValue(v["severity"])))
+	field("Found", render.StringValue(v["timestamp"]))
+	field("Agent", render.StringValue(v["agent_name"]))
+	field("Target", render.StringValue(v["target"]))
+	if dep, ok := v["dependency_metadata"].(map[string]any); ok {
+		field("Package", render.StringValue(dep["package_name"]))
+		field("Ecosystem", render.StringValue(dep["package_ecosystem"]))
+		field("Installed Version", render.StringValue(dep["installed_version"]))
+		field("Fixed Version", render.StringValue(dep["fixed_version"]))
+		field("Introduced By", render.StringValue(dep["introduced_by"]))
+		field("Dependency Chain", render.StringValue(dep["dependency_path"]))
+	}
+	field("Endpoint", render.StringValue(v["endpoint"]))
+	field("Method", render.StringValue(v["method"]))
+	field("CVE", render.StringValue(v["cve"]))
+	field("CWE", render.StringValue(v["cwe"]))
+	field("CVSS", render.StringValue(v["cvss"]))
+	if fe := render.StringValue(v["fix_effort"]); fe != "" {
+		field("Fix Effort", titleCaseWords(fe))
+	}
+	if bd, ok := v["cvss_breakdown"].(map[string]any); ok && len(bd) > 0 {
+		if parts := render.CVSSVectorParts(bd); len(parts) > 0 {
+			field("CVSS Vector", strings.Join(parts, "/"))
+		}
+	}
+
+	description := render.StringValue(v["description"])
+	if description == "" {
+		description = "No description provided."
+	}
+	lines = append(lines, "", "## Description", "", description)
+
+	section := func(label, value string) {
+		if value != "" {
+			lines = append(lines, "", "## "+label, "", value)
+		}
+	}
+	section("Impact", render.StringValue(v["impact"]))
+	section("Technical Analysis", render.StringValue(v["technical_analysis"]))
+	section("Evidence", render.StringValue(v["evidence"]))
+
+	pocDescription := render.StringValue(v["poc_description"])
+	pocScript := render.StringValue(v["poc_script_code"])
+	if pocDescription != "" || pocScript != "" {
+		lines = append(lines, "", "## Proof of Concept", "")
+		if pocDescription != "" {
+			lines = append(lines, pocDescription, "")
+		}
+		if pocScript != "" {
+			pocLang, pocCode := render.ParseFencedCode(pocScript)
+			if pocLang == "" {
+				pocLang = guessLanguageName(pocCode)
+			}
+			fence := safeFence(pocCode)
+			lines = append(lines, fence+pocLang, pocCode, fence)
+		}
+	}
+
+	if locations, ok := v["code_locations"].([]any); ok && len(locations) > 0 {
+		lines = append(lines, "", "## Code Analysis", "")
+		for i, item := range locations {
+			loc, ok := item.(map[string]any)
+			if !ok {
+				continue
+			}
+			file := render.StringValue(loc["file"])
+			if file == "" {
+				file = "unknown"
+			}
+			lineRef := ""
+			if start := render.StringValue(loc["start_line"]); start != "" {
+				if end := render.StringValue(loc["end_line"]); end != "" && end != start {
+					lineRef = fmt.Sprintf(" (lines %s-%s)", start, end)
+				} else {
+					lineRef = fmt.Sprintf(" (line %s)", start)
+				}
+			}
+			lines = append(lines, fmt.Sprintf("**Location %d:** `%s`%s", i+1, file, lineRef))
+			if label := render.StringValue(loc["label"]); label != "" {
+				lines = append(lines, "  "+label)
+			}
+			if snippet := render.StringValue(loc["snippet"]); snippet != "" {
+				fence := safeFence(snippet)
+				lines = append(lines, fence+"\n"+snippet+"\n"+fence)
+			}
+			before := render.StringValue(loc["fix_before"])
+			after := render.StringValue(loc["fix_after"])
+			if before != "" || after != "" {
+				lines = append(lines, "**Suggested Fix:**", "```diff")
+				if before != "" {
+					for _, l := range strings.Split(before, "\n") {
+						lines = append(lines, "- "+l)
+					}
+				}
+				if after != "" {
+					for _, l := range strings.Split(after, "\n") {
+						lines = append(lines, "+ "+l)
+					}
+				}
+				lines = append(lines, "```")
+			}
+			lines = append(lines, "")
+		}
+	}
+
+	section("Remediation", render.StringValue(v["remediation_steps"]))
+	section("Assumptions", render.StringValue(v["assumptions"]))
+
+	lines = append(lines, "")
+	return strings.Join(lines, "\n")
+}
@@ -0,0 +1,536 @@
+package app
+
+import (
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/ansi"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+var panelSeverityColors = map[string]lipgloss.Color{
+	"critical": render.SevCrit, "high": render.SevHigh, "medium": render.SevMed, "low": green, "info": blue,
+}
+
+// vulnerabilityRow is one rendered line of the findings list. The list scrolls by
+// row rather than by finding, so a long title does not make the panel jump a
+// whole entry at a time.
+type vulnerabilityRow struct {
+	index int    // the finding this line belongs to
+	text  string // one wrapped line of its title
+	first bool   // the line that carries the number and the severity dot
+}
+
+// vulnerabilityRows lays every finding out as the lines it will occupy.
+func (m Model) vulnerabilityRows(width int) []vulnerabilityRow {
+	// Wrapped lines sit under the title rather than under the severity dot.
+	body := max(1, width-2)
+	rows := make([]vulnerabilityRow, 0, len(m.snapshot.Vulnerabilities))
+	for i := range m.snapshot.Vulnerabilities {
+		for line, text := range strings.Split(wrapBlock(m.vulnerabilityTitle(i), body), "\n") {
+			rows = append(rows, vulnerabilityRow{index: i, text: text, first: line == 0})
+		}
+	}
+	return rows
+}
+
+func (m Model) vulnerabilitiesView(width, height int) string {
+	rows := m.vulnerabilityRows(width)
+	start := min(max(0, m.vulnOffset), max(0, len(rows)-1))
+	end := min(len(rows), start+height)
+	lines := make([]string, 0, max(0, end-start))
+	for _, row := range rows[start:end] {
+		style := lipgloss.NewStyle().Foreground(textColor)
+		if row.index == m.selectedVuln {
+			style = style.Bold(true).Foreground(white)
+		}
+		prefix := "  "
+		if row.first {
+			severity := strings.ToLower(render.StringValue(m.snapshot.Vulnerabilities[row.index]["severity"]))
+			color, ok := panelSeverityColors[severity]
+			if !ok {
+				color = blue // matches SEVERITY_COLORS.get(severity, "#3b82f6")
+			}
+			prefix = lipgloss.NewStyle().Foreground(color).Render("● ")
+		}
+		lines = append(lines, prefix+style.Render(row.text))
+	}
+	return strings.Join(lines, "\n")
+}
+
+// vulnerabilityListWidth is the one width the findings list is laid out at, for
+// rendering and for every interaction alike. Wrapping a title at two widths a
+// column apart gives two different row counts, and then a click resolves to the
+// wrong finding and the scrollbar reports the wrong length.
+//
+// The panel is sidebarWidth-2 wide with a column of padding either side, and the
+// scrollbar takes one more. That last column is reserved whether or not the bar
+// is showing, so the layout does not shift as the list grows past the panel.
+func (m Model) vulnerabilityListWidth() int {
+	_, sidebarWidth, _, _ := m.layout()
+	return max(1, sidebarWidth-5)
+}
+
+func (m Model) vulnerabilityTitle(index int) string {
+	title := render.StringValue(m.snapshot.Vulnerabilities[index]["title"])
+	if title == "" {
+		title = "Unknown Vulnerability"
+	}
+	return title
+}
+
+// vulnerabilityScrollRows reports the list length and position in rows, which is
+// what the scrollbar needs to move continuously.
+func (m Model) vulnerabilityScrollRows() (total, offset int) {
+	return len(m.vulnerabilityRows(m.vulnerabilityListWidth())), m.vulnOffset
+}
+
+// vulnerabilityIndexAtRow maps a click on a visible row back to its finding.
+func (m Model) vulnerabilityIndexAtRow(row int) int {
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	target := m.vulnOffset + row
+	if target < 0 || target >= len(rows) {
+		return -1
+	}
+	return rows[target].index
+}
+
+// ensureVulnerabilityVisible scrolls the least it can to bring the selected
+// finding into view, keeping the whole entry visible where it fits.
+func (m *Model) ensureVulnerabilityVisible() {
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	if len(rows) == 0 {
+		m.vulnOffset = 0
+		return
+	}
+	height := m.vulnerabilityPageSize()
+	firstRow, lastRow := -1, -1
+	for row, entry := range rows {
+		if entry.index != m.selectedVuln {
+			continue
+		}
+		if firstRow < 0 {
+			firstRow = row
+		}
+		lastRow = row
+	}
+	if firstRow < 0 {
+		m.vulnOffset = clampVulnerabilityOffset(m.vulnOffset, len(rows), height)
+		return
+	}
+	if firstRow < m.vulnOffset {
+		m.vulnOffset = firstRow
+	} else if lastRow >= m.vulnOffset+height {
+		// Prefer showing the whole entry, but never scroll its start out of view.
+		m.vulnOffset = min(firstRow, lastRow-height+1)
+	}
+	m.vulnOffset = clampVulnerabilityOffset(m.vulnOffset, len(rows), height)
+}
+
+func clampVulnerabilityOffset(offset, total, height int) int {
+	return min(max(0, offset), max(0, total-height))
+}
+
+func (m Model) vulnerabilityPageSize() int {
+	_, vulnHeight, _ := m.sidebarHeights()
+	return max(1, vulnHeight-2)
+}
+
+// vulnerabilityPageItems is how many findings a page step should move by: the
+// number of distinct entries currently on screen.
+func (m Model) vulnerabilityPageItems() int {
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	height := m.vulnerabilityPageSize()
+	start := min(max(0, m.vulnOffset), max(0, len(rows)))
+	end := min(len(rows), start+height)
+	seen := 0
+	previous := -1
+	for _, row := range rows[start:end] {
+		if row.index != previous {
+			seen++
+			previous = row.index
+		}
+	}
+	return max(1, seen)
+}
+
+func (m *Model) moveVulnerabilitySelection(delta int) {
+	m.selectedVuln = max(0, min(len(m.snapshot.Vulnerabilities)-1, m.selectedVuln+delta))
+}
+
+// keepVulnerabilitySelectionInWindow pulls the selection to the nearest finding
+// still on screen after the list has been scrolled directly.
+func (m *Model) keepVulnerabilitySelectionInWindow() {
+	rows := m.vulnerabilityRows(m.vulnerabilityListWidth())
+	if len(rows) == 0 {
+		return
+	}
+	height := m.vulnerabilityPageSize()
+	start := min(max(0, m.vulnOffset), max(0, len(rows)-1))
+	end := min(len(rows), start+height)
+	visible := rows[start:end]
+	if len(visible) == 0 {
+		return
+	}
+	for _, row := range visible {
+		if row.index == m.selectedVuln {
+			return
+		}
+	}
+	if m.selectedVuln < visible[0].index {
+		m.selectedVuln = visible[0].index
+		return
+	}
+	m.selectedVuln = visible[len(visible)-1].index
+}
+
+// statsView ports build_tui_stats_text + the version line appended in
+// _update_stats_display: model, token/cost line, optional Caido URL, version.
+func (m Model) modalView() string {
+	switch m.modal {
+	case modalHelp:
+		title := lipgloss.NewStyle().Bold(true).Foreground(green).Width(34).Align(lipgloss.Center).Render("Strix Help")
+		body := lipgloss.NewStyle().Foreground(textColor).Render("F1        Help\nCtrl+O    Open viewer\nCtrl+Q/C  Quit\nESC       Stop Agent\nEnter     Send / expand node\nCtrl+J    Newline in message\nTab       Switch panels\n↑/↓       Navigate tree\nDrag      Select & copy text\nClick     Expand/collapse tool")
+		content := title + "\n\n" + body
+		return lipgloss.NewStyle().Width(38).Border(lipgloss.RoundedBorder()).BorderForeground(green).Background(black).Padding(1, 2).Render(content)
+	case modalQuit:
+		// #quit_dialog: width 24, border round #333333, title #d4d4d4.
+		return m.confirmView("Quit Strix?", 24, dark, textColor)
+	case modalStop:
+		name := "agent"
+		if len(m.snapshot.Agents) > 0 {
+			name = m.snapshot.Agents[m.selectedAgent].Name
+		}
+		// #stop_agent_dialog: width 30, border round #a3a3a3, title #a3a3a3.
+		return m.confirmView("🛑 Stop '"+name+"'?", 30, mid, mid)
+	case modalConfirmMount:
+		return m.mountConfirmView()
+	case modalVulnerability:
+		if len(m.snapshot.Vulnerabilities) == 0 {
+			return ""
+		}
+		return m.vulnerabilityDetail()
+	}
+	return ""
+}
+
+func (m Model) confirmView(title string, width int, border, titleColor lipgloss.Color) string {
+	return m.confirmDialog(title, "", width, border, titleColor, red, "Yes", "No")
+}
+
+// mountConfirmView asks before a target-less scan mounts the working directory.
+// It is a compact prompt docked in the corner of the live view: nothing is
+// prepared until it is answered, and the directory is a workspace rather than a
+// target, so the prompt is what the scan follows.
+func (m Model) mountConfirmView() string {
+	width := min(52, max(20, m.width-4))
+	dir := strings.TrimSpace(m.snapshot.PendingMount)
+	if dir == "" {
+		dir = "the current directory"
+	}
+	title := render.Bold(amber).Render("△ Mount working directory?")
+	body := render.Col(white).Render(truncatePath(dir, width-4)) + "\n" +
+		render.Dim().Render("writable in the sandbox")
+	return m.cornerPrompt(title, body, width, "Confirm", "Cancel")
+}
+
+// truncatePath keeps the tail of a path visible, which is the part that
+// identifies the directory.
+func truncatePath(path string, width int) string {
+	if width <= 1 || lipgloss.Width(path) <= width {
+		return path
+	}
+	return "…" + ansi.TruncateLeft(path, lipgloss.Width(path)-width+1, "")
+}
+
+// cornerPrompt renders a compact two-button prompt for the corner of the live
+// view, sized to its content rather than centered like the modal dialogs.
+func (m Model) cornerPrompt(title, body string, width int, confirmLabel, cancelLabel string) string {
+	// Each label keeps its padding whether or not it is focused, so moving the
+	// choice repaints a background instead of shifting the pair sideways.
+	button := func(label string, focused bool, fill lipgloss.Color) string {
+		style := lipgloss.NewStyle().Bold(true)
+		if focused {
+			return style.Background(fill).Foreground(brightWhite).Render(" " + label + " ")
+		}
+		return style.Foreground(fill).Render(" " + label + " ")
+	}
+	yes := button(confirmLabel, m.modalChoice == 0, amber)
+	no := button(cancelLabel, m.modalChoice != 0, dim)
+	if m.modalChoice != 0 {
+		no = button(cancelLabel, true, lipgloss.Color("#3e3e3e"))
+	}
+	inner := lipgloss.NewStyle().Width(width - 4)
+	content := inner.Render(title) + "\n" + inner.Render(body) + "\n" +
+		inner.Align(lipgloss.Right).Render(yes+" "+no)
+	return lipgloss.NewStyle().Width(width-2).Border(lipgloss.RoundedBorder()).
+		BorderForeground(amber).Background(black).Padding(0, 1).Render(content)
+}
+
+// confirmDialog renders a two-button prompt. The focused button fills its
+// background; body is optional detail shown between the title and the buttons.
+func (m Model) confirmDialog(
+	title, body string,
+	width int,
+	border, titleColor, confirmColor lipgloss.Color,
+	confirmLabel, cancelLabel string,
+) string {
+	// Two equal columns with a one-cell gutter. The buttons keep their columns
+	// whichever one is focused, so moving the choice repaints a background
+	// instead of shifting the row.
+	contentWidth := width - 4
+	inner := lipgloss.NewStyle().Width(contentWidth)
+	// Two columns share the content width with a one-cell gutter; the label
+	// carries a space on each side before it is centered in its column.
+	leftColumn := (contentWidth - 1) / 2
+	rightColumn := contentWidth - 1 - leftColumn
+	button := func(label string, column int, focused bool, fill lipgloss.Color) string {
+		style := lipgloss.NewStyle().Width(column).Align(lipgloss.Center).Bold(true)
+		if focused {
+			return style.Background(fill).Foreground(brightWhite).Render(" " + label + " ")
+		}
+		return style.Foreground(fill).Render(" " + label + " ")
+	}
+	yes := button(confirmLabel, leftColumn, m.modalChoice == 0, confirmColor)
+	no := button(cancelLabel, rightColumn, false, dim)
+	if m.modalChoice != 0 {
+		no = button(cancelLabel, rightColumn, true, lipgloss.Color("#3e3e3e"))
+	}
+	content := inner.Bold(true).Foreground(titleColor).Align(lipgloss.Center).Render(title)
+	if body != "" {
+		content += "\n\n" + inner.Render(body)
+	}
+	content += "\n\n" + inner.Align(lipgloss.Center).Render(yes+" "+no)
+	// Width() sets the content box, so the border's two columns come off it to
+	// keep the dialog the width the design calls for.
+	return lipgloss.NewStyle().Width(width - 2).Border(lipgloss.RoundedBorder()).BorderForeground(border).Background(black).Padding(1).Render(content)
+}
+
+// vulnerabilityBody ports VulnerabilityDetailScreen._render_vulnerability:
+// the exact field order, labels, colors, and dict keys.
+func vulnerabilityBody(v map[string]any) string {
+	fieldStyle := render.Bold(render.Field)
+	var b strings.Builder
+	b.WriteString("🐞 " + render.Bold(render.ReportHdr).Render("Vulnerability Report"))
+
+	field := func(label, value string) {
+		if value != "" {
+			b.WriteString("\n\n" + fieldStyle.Render(label+": ") + value)
+		}
+	}
+	field("Agent", render.StringValue(v["agent_name"]))
+	field("Title", render.StringValue(v["title"]))
+	if sev := render.StringValue(v["severity"]); sev != "" {
+		b.WriteString("\n\n" + fieldStyle.Render("Severity: ") +
+			lipgloss.NewStyle().Bold(true).Foreground(render.SeverityColor(sev)).Render(strings.ToUpper(sev)))
+	}
+	if score, ok := render.NumericValue(v["cvss"]); ok {
+		b.WriteString("\n\n" + fieldStyle.Render("CVSS Score: ") +
+			lipgloss.NewStyle().Bold(true).Foreground(render.CVSSColor(score)).Render(render.StringValue(v["cvss"])))
+	}
+	field("Target", render.StringValue(v["target"]))
+	if dep, ok := v["dependency_metadata"].(map[string]any); ok {
+		field("Package", render.StringValue(dep["package_name"]))
+		field("Ecosystem", render.StringValue(dep["package_ecosystem"]))
+		field("Installed Version", render.StringValue(dep["installed_version"]))
+		field("Fixed Version", render.StringValue(dep["fixed_version"]))
+		field("Introduced By", render.StringValue(dep["introduced_by"]))
+		field("Dependency Chain", render.StringValue(dep["dependency_path"]))
+	}
+	field("Endpoint", render.StringValue(v["endpoint"]))
+	field("Method", render.StringValue(v["method"]))
+	field("CVE", render.StringValue(v["cve"]))
+	field("CWE", render.StringValue(v["cwe"]))
+	if fe := render.StringValue(v["fix_effort"]); fe != "" {
+		field("Fix Effort", titleCase(fe))
+	}
+	if bd, ok := v["cvss_breakdown"].(map[string]any); ok && len(bd) > 0 {
+		if parts := render.CVSSVectorParts(bd); len(parts) > 0 {
+			b.WriteString("\n\n" + fieldStyle.Render("CVSS Vector: ") + render.Dim().Render(strings.Join(parts, "/")))
+		}
+	}
+
+	section := func(label, value string) {
+		if value != "" {
+			b.WriteString("\n\n" + fieldStyle.Render(label) + "\n" + value)
+		}
+	}
+	section("Description", render.StringValue(v["description"]))
+	section("Impact", render.StringValue(v["impact"]))
+	section("Technical Analysis", render.StringValue(v["technical_analysis"]))
+	section("Evidence", render.StringValue(v["evidence"]))
+	section("PoC Description", render.StringValue(v["poc_description"]))
+	if poc := render.StringValue(v["poc_script_code"]); poc != "" {
+		pocLang, pocCode := render.ParseFencedCode(poc)
+		b.WriteString("\n\n" + fieldStyle.Render("PoC Code") + "\n" + render.HighlightCode(pocCode, pocLang))
+	}
+	section("Remediation", render.StringValue(v["remediation_steps"]))
+	section("Assumptions", render.StringValue(v["assumptions"]))
+	return b.String()
+}
+
+func (m Model) vulnerabilityDialogSize() (width, height int) {
+	return min(m.width, min(110, max(40, m.width*85/100))), min(m.height, min(45, max(10, m.height*85/100)))
+}
+
+func (m *Model) resizeVulnerabilityViewport() {
+	if m.modal != modalVulnerability || len(m.snapshot.Vulnerabilities) == 0 {
+		return
+	}
+	width, height := m.vulnerabilityDialogSize()
+	innerWidth := max(1, width-8)               // border plus three cells of horizontal padding
+	m.vulnViewport.Width = max(1, innerWidth-2) // right padding and one-cell scrollbar
+	m.vulnViewport.Height = max(1, height-9)    // padding, one-row grid gutter, and two-row footer
+	m.vulnViewport.SetContent(wrapBlock(vulnerabilityBody(m.snapshot.Vulnerabilities[m.selectedVuln]), m.vulnViewport.Width))
+	m.vulnViewport.SetYOffset(m.vulnViewport.YOffset)
+}
+
+func (m Model) vulnerabilityScrollView() string {
+	view := m.vulnViewport.View()
+	if m.vulnViewport.TotalLineCount() <= m.vulnViewport.VisibleLineCount() {
+		return view + "  "
+	}
+	height := m.vulnViewport.Height
+	thumbHeight := max(1, height*m.vulnViewport.VisibleLineCount()/m.vulnViewport.TotalLineCount())
+	thumbStart := int(m.vulnViewport.ScrollPercent() * float64(height-thumbHeight))
+	bar := make([]string, height)
+	for row := range bar {
+		cell := " "
+		if row >= thumbStart && row < thumbStart+thumbHeight {
+			cell = lipgloss.NewStyle().Foreground(lipgloss.Color("#404040")).Render("█")
+		}
+		bar[row] = cell
+	}
+	return lipgloss.JoinHorizontal(lipgloss.Top, view, " ", strings.Join(bar, "\n"))
+}
+
+func (m Model) vulnerabilityDetail() string {
+	width, height := m.vulnerabilityDialogSize()
+	inner := max(1, width-8)
+	// Button row: right-aligned Copy / Done above a top rule (#vuln_detail_buttons).
+	rule := lipgloss.NewStyle().Foreground(lipgloss.Color("#1a1a1a")).Render(strings.Repeat("─", max(1, inner)))
+	focused := m.focusedReportButton()
+	var stepping, acting []string
+	for _, button := range m.reportButtons() {
+		rendered := m.reportButton(button, button == focused)
+		if button == reportPrev || button == reportNext {
+			stepping = append(stepping, rendered)
+			continue
+		}
+		acting = append(acting, rendered)
+	}
+	// Stepping sits on the left behind the position, acting on the right.
+	right := strings.Join(acting, "  ")
+	left := strings.Join(stepping, "  ")
+	if total := len(m.snapshot.Vulnerabilities); total > 1 {
+		left = render.Dim().Render(fmt.Sprintf("%d/%d", m.selectedVuln+1, total)) + "  " + left
+	}
+	room := max(0, inner-lipgloss.Width(right))
+	buttonRow := rule + "\n" +
+		lipgloss.NewStyle().Width(room).Render(truncate(left, room)) + right
+	content := m.vulnerabilityScrollView() + "\n" + buttonRow
+	return lipgloss.NewStyle().Width(width-2).Height(height-2).Border(lipgloss.NormalBorder()).BorderForeground(lipgloss.Color("#262626")).Background(lipgloss.Color("#0a0a0a")).Padding(2, 3).Render(content)
+}
+
+// showVulnerability moves the open report to another finding, keeping the list
+// behind it in step and starting the new report at its top.
+func (m *Model) showVulnerability(index int) {
+	if index < 0 || index >= len(m.snapshot.Vulnerabilities) || index == m.selectedVuln {
+		return
+	}
+	m.selectedVuln = index
+	m.ensureVulnerabilityVisible()
+	// The copy state belongs to the report that was on screen, not this one.
+	m.vulnerabilityCopied = false
+	m.vulnerabilityCopyError = ""
+	m.resizeVulnerabilityViewport()
+	m.vulnViewport.GotoTop()
+}
+
+// The report's buttons. Prev and Next carry their arrows so a click test cannot
+// be fooled by the same word appearing in the body of a finding.
+const (
+	reportPrev = "‹ Prev"
+	reportNext = "Next ›"
+	reportCopy = "Copy"
+	reportDone = "Done"
+)
+
+// reportButtons is the row as it stands, left to right. Stepping is offered only
+// in the directions that have a report.
+func (m Model) reportButtons() []string {
+	previous, next := m.vulnerabilityNeighbors()
+	buttons := make([]string, 0, 4)
+	if previous {
+		buttons = append(buttons, reportPrev)
+	}
+	if next {
+		buttons = append(buttons, reportNext)
+	}
+	return append(buttons, reportCopy, reportDone)
+}
+
+// focusedReportButton is the button Enter would press. It falls back to Done when
+// the focused one has gone, which happens when stepping to either end drops a
+// direction from the row.
+func (m Model) focusedReportButton() string {
+	for _, button := range m.reportButtons() {
+		if button == m.reportFocus {
+			return button
+		}
+	}
+	return reportDone
+}
+
+// stepReportFocus moves along the row, wrapping at its ends.
+func (m *Model) stepReportFocus(delta int) {
+	buttons := m.reportButtons()
+	current := 0
+	for i, button := range buttons {
+		if button == m.focusedReportButton() {
+			current = i
+		}
+	}
+	m.reportFocus = buttons[clampCycle(current+delta, len(buttons))]
+}
+
+// vulnerabilityNeighbors reports which way the open report can be stepped. The
+// ends are not wrapped: a report is one of an ordered list, and rolling from the
+// last to the first hides that you reached the end.
+func (m Model) vulnerabilityNeighbors() (previous, next bool) {
+	return m.selectedVuln > 0, m.selectedVuln < len(m.snapshot.Vulnerabilities)-1
+}
+
+// reportButton renders one button of the report row. Copy reports the outcome of
+// the last attempt in its own label.
+func (m Model) reportButton(label string, focused bool) string {
+	if label == reportCopy {
+		switch {
+		case m.vulnerabilityCopied:
+			label = "Copied!"
+		case m.vulnerabilityCopyError != "":
+			label = "Copy failed"
+		}
+	}
+	if focused {
+		return lipgloss.NewStyle().Background(lipgloss.Color("#363636")).
+			Foreground(brightWhite).Bold(true).Padding(0, 1).Render(label)
+	}
+	return lipgloss.NewStyle().Foreground(lipgloss.Color("#525252")).Render(label)
+}
+
+func (m *Model) startVulnerabilityCopy() tea.Cmd {
+	m.vulnerabilityCopied = false
+	m.vulnerabilityCopyError = ""
+	if m.selectedVuln < 0 || m.selectedVuln >= len(m.snapshot.Vulnerabilities) {
+		return nil
+	}
+	report := vulnerabilityMarkdownReport(m.snapshot.Vulnerabilities[m.selectedVuln])
+	return func() tea.Msg {
+		return vulnerabilityCopiedMsg{err: writeClipboard(report)}
+	}
+}
+
+// titleCase upper-cases the first letter of each word (Python str.title()).
@@ -0,0 +1,467 @@
+package app
+
+import (
+	"encoding/json"
+	"strings"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/usestrix/strix/tui/internal/protocol"
+	"github.com/usestrix/strix/tui/internal/render"
+)
+
+func (m *Model) handleEnvelope(envelope protocol.Envelope) tea.Cmd {
+	switch envelope.Type {
+	case "state":
+		var update protocol.StateUpdate
+		if err := json.Unmarshal(envelope.Payload, &update); err != nil {
+			m.errorText = err.Error()
+			return nil
+		}
+		if update.Revision <= m.stateRevision {
+			return nil
+		}
+		selectedAgentID := ""
+		if m.selectedAgent >= 0 && m.selectedAgent < len(m.snapshot.Agents) {
+			selectedAgentID = m.snapshot.Agents[m.selectedAgent].ID
+		}
+		update.State.Events = m.snapshot.Events
+		update.State.Vulnerabilities = m.snapshot.Vulnerabilities
+		update.State.Agents = m.snapshot.Agents
+		m.consumeMessages(update.State.Messages, update.State.SetupMode)
+		m.snapshot = update.State
+		m.stateRevision = update.Revision
+		if m.snapshot.Error != nil {
+			m.errorText = *m.snapshot.Error
+		}
+		if m.snapshot.SetupMode {
+			// The start screen is its own landing page; never sit on the
+			// splash before it.
+			m.showSplash = false
+			m.input.Placeholder = setupPlaceholder
+		} else {
+			m.input.Placeholder = chatPlaceholder
+		}
+		m.selectedAgent = selectedAgentIndex(m.snapshot.Agents, selectedAgentID)
+		m.selectedVuln = min(m.selectedVuln, max(0, len(m.snapshot.Vulnerabilities)-1))
+		if m.modal == modalStop && !m.selectedAgentCanStop() {
+			m.closeModal()
+		}
+		m.syncMountPrompt()
+		m.ensureAgentVisible()
+		m.ensureVulnerabilityVisible()
+		m.ready = true
+		// resize (not just refresh): status-row visibility changes the chat height.
+		m.resizeViewport()
+		m.resizeVulnerabilityViewport()
+	case "collection_bootstrap":
+		return m.handleCollectionBootstrap(envelope.Payload)
+	case "collection_delta":
+		return m.handleCollectionDelta(envelope.Payload)
+	case "command_result":
+		if m.client == nil {
+			return nil
+		}
+		expectedCommand, pending := m.client.ExpectedCommand(envelope.RequestID)
+		if !pending {
+			return nil
+		}
+		var result protocol.CommandResult
+		if err := json.Unmarshal(envelope.Payload, &result); err != nil {
+			m.errorText = err.Error()
+			return nil
+		}
+		if result.Command != expectedCommand || !m.client.Resolve(envelope.RequestID, result.Command) {
+			return nil
+		}
+		if !result.OK {
+			if result.Command == "collection.resync" {
+				if collection := m.resyncRequests[envelope.RequestID]; collection != "" {
+					m.resyncRequested[collection] = false
+					delete(m.resyncRequests, envelope.RequestID)
+				}
+			}
+			message := "Command failed"
+			if result.Error != nil && strings.TrimSpace(result.Error.Message) != "" {
+				message = result.Error.Message
+			}
+			// Setup-mode errors live in the scrollback (red), like Python; during
+			// a scan they surface on the status line.
+			if m.snapshot.SetupMode {
+				m.setupMsg(message, render.Col(red))
+			} else {
+				m.errorText = message
+			}
+			return nil
+		}
+		if m.snapshot.ScanStarted && !m.snapshot.SetupMode && strings.HasPrefix(result.Command, "setup.") {
+			return nil
+		}
+		m.errorText = ""
+		switch result.Command {
+		case "viewer.open":
+			var data struct {
+				Status string  `json:"status"`
+				URL    *string `json:"url"`
+			}
+			_ = json.Unmarshal(result.Result, &data)
+			m.snapshot.ViewerStatus = data.Status
+			m.snapshot.ViewerURL = data.URL
+		}
+	}
+	return nil
+}
+
+func (m *Model) consumeMessages(messages []protocol.Message, setupMode bool) {
+	if m.seenMessages == nil {
+		m.seenMessages = map[string]bool{}
+	}
+	for _, message := range messages {
+		key := message.ID
+		if key == "" {
+			key = message.Level + "\x00" + message.Text
+		}
+		if m.seenMessages[key] {
+			continue
+		}
+		m.seenMessages[key] = true
+		if !setupMode || strings.TrimSpace(message.Text) == "" {
+			continue
+		}
+		style := render.Dim()
+		switch message.Level {
+		case "error":
+			style = render.Col(red)
+		case "warning":
+			style = render.Col(amber)
+		}
+		m.setupMsg(message.Text, style)
+	}
+}
+
+func validCollection(name string) bool {
+	return name == "agents" || name == "events" || name == "vulnerabilities"
+}
+
+func (m *Model) collectionMismatch(name string) tea.Cmd {
+	delete(m.collectionAssemblies, name)
+	if !validCollection(name) || m.resyncRequested[name] || m.client == nil {
+		return nil
+	}
+	m.resyncRequested[name] = true
+	return send(m.client, "collection.resync", map[string]any{"collection": name})
+}
+
+func (m *Model) clearCollectionResync(name string) {
+	m.resyncRequested[name] = false
+	for requestID, collection := range m.resyncRequests {
+		if collection == name {
+			delete(m.resyncRequests, requestID)
+		}
+	}
+}
+
+func (m *Model) handleCollectionBootstrap(payload json.RawMessage) tea.Cmd {
+	var chunk protocol.CollectionBootstrap
+	if err := json.Unmarshal(payload, &chunk); err != nil {
+		m.errorText = err.Error()
+		return nil
+	}
+	if !validCollection(chunk.Collection) {
+		m.errorText = "Unknown collection: " + chunk.Collection
+		return nil
+	}
+	if chunk.Cursor == 0 {
+		m.resyncRequested[chunk.Collection] = false
+	}
+	if chunk.Cursor == 0 {
+		if chunk.Revision <= m.collectionRevisions[chunk.Collection] {
+			return nil
+		}
+		m.collectionAssemblies[chunk.Collection] = &collectionAssembly{
+			kind: "bootstrap", revision: chunk.Revision, ids: map[string]bool{},
+		}
+	}
+	assembly := m.collectionAssemblies[chunk.Collection]
+	if assembly == nil || assembly.kind != "bootstrap" || assembly.revision != chunk.Revision || assembly.cursor != chunk.Cursor {
+		return m.collectionMismatch(chunk.Collection)
+	}
+	if chunk.NextCursor != chunk.Cursor+len(chunk.Items) {
+		return m.collectionMismatch(chunk.Collection)
+	}
+	for _, raw := range chunk.Items {
+		if chunk.Collection == "agents" {
+			var agent protocol.Agent
+			if err := json.Unmarshal(raw, &agent); err != nil || agent.ID == "" {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			if assembly.ids[agent.ID] {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			assembly.ids[agent.ID] = true
+			assembly.agents = append(assembly.agents, agent)
+		} else if chunk.Collection == "events" {
+			var event protocol.Event
+			if err := json.Unmarshal(raw, &event); err != nil || event.ID == "" {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			if assembly.ids[event.ID] {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			assembly.ids[event.ID] = true
+			assembly.events = append(assembly.events, event)
+		} else {
+			var finding map[string]any
+			if err := json.Unmarshal(raw, &finding); err != nil || collectionItemID(finding) == "" {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			id := collectionItemID(finding)
+			if assembly.ids[id] {
+				return m.collectionMismatch(chunk.Collection)
+			}
+			assembly.ids[id] = true
+			assembly.findings = append(assembly.findings, finding)
+		}
+	}
+	assembly.cursor = chunk.NextCursor
+	if !chunk.Done {
+		return nil
+	}
+	if chunk.Collection == "agents" {
+		selectedAgentID := m.selectedAgentID()
+		m.snapshot.Agents = assembly.agents
+		m.selectedAgent = selectedAgentIndex(m.snapshot.Agents, selectedAgentID)
+	} else if chunk.Collection == "events" {
+		m.snapshot.Events = assembly.events
+	} else {
+		m.snapshot.Vulnerabilities = assembly.findings
+	}
+	m.collectionRevisions[chunk.Collection] = chunk.Revision
+	delete(m.collectionAssemblies, chunk.Collection)
+	m.clearCollectionResync(chunk.Collection)
+	return m.refreshAfterCollection(chunk.Collection)
+}
+
+func (m *Model) handleCollectionDelta(payload json.RawMessage) tea.Cmd {
+	var chunk protocol.CollectionDelta
+	if err := json.Unmarshal(payload, &chunk); err != nil {
+		m.errorText = err.Error()
+		return nil
+	}
+	if !validCollection(chunk.Collection) {
+		m.errorText = "Unknown collection: " + chunk.Collection
+		return nil
+	}
+	if chunk.Cursor == 0 {
+		if chunk.BaseRevision != m.collectionRevisions[chunk.Collection] || chunk.Revision <= chunk.BaseRevision {
+			return m.collectionMismatch(chunk.Collection)
+		}
+		m.collectionAssemblies[chunk.Collection] = &collectionAssembly{
+			kind: "delta", revision: chunk.Revision, baseRevision: chunk.BaseRevision,
+		}
+	}
+	assembly := m.collectionAssemblies[chunk.Collection]
+	if assembly == nil || assembly.kind != "delta" || assembly.revision != chunk.Revision ||
+		assembly.baseRevision != chunk.BaseRevision || assembly.cursor != chunk.Cursor {
+		return m.collectionMismatch(chunk.Collection)
+	}
+	if chunk.NextCursor != chunk.Cursor+len(chunk.Operations) {
+		return m.collectionMismatch(chunk.Collection)
+	}
+	assembly.operations = append(assembly.operations, chunk.Operations...)
+	assembly.cursor = chunk.NextCursor
+	if !chunk.Done {
+		return nil
+	}
+	if !m.applyCollectionOperations(chunk.Collection, assembly.operations) {
+		return m.collectionMismatch(chunk.Collection)
+	}
+	m.collectionRevisions[chunk.Collection] = chunk.Revision
+	delete(m.collectionAssemblies, chunk.Collection)
+	m.clearCollectionResync(chunk.Collection)
+	return m.refreshAfterCollection(chunk.Collection)
+}
+
+func (m *Model) applyCollectionOperations(name string, operations []protocol.CollectionOperation) bool {
+	seen := make(map[string]bool, len(operations))
+	if name == "agents" {
+		selectedAgentID := m.selectedAgentID()
+		values := append([]protocol.Agent(nil), m.snapshot.Agents...)
+		positions := make(map[string]int, len(values))
+		for index, agent := range values {
+			positions[agent.ID] = index
+		}
+		for _, operation := range operations {
+			if operation.Op == "delete" {
+				if operation.ID == "" || seen[operation.ID] {
+					return false
+				}
+				seen[operation.ID] = true
+				index, exists := positions[operation.ID]
+				if !exists {
+					return false
+				}
+				values = append(values[:index], values[index+1:]...)
+				positions = make(map[string]int, len(values))
+				for position, value := range values {
+					positions[value.ID] = position
+				}
+				continue
+			}
+			if operation.Op != "upsert" {
+				return false
+			}
+			var agent protocol.Agent
+			if err := json.Unmarshal(operation.Item, &agent); err != nil || agent.ID == "" || seen[agent.ID] {
+				return false
+			}
+			seen[agent.ID] = true
+			if index, exists := positions[agent.ID]; exists {
+				values[index] = agent
+			} else {
+				positions[agent.ID] = len(values)
+				values = append(values, agent)
+			}
+		}
+		m.snapshot.Agents = values
+		m.selectedAgent = selectedAgentIndex(values, selectedAgentID)
+		return true
+	}
+	if name == "events" {
+		values := append([]protocol.Event(nil), m.snapshot.Events...)
+		positions := make(map[string]int, len(values))
+		for index, event := range values {
+			positions[event.ID] = index
+		}
+		for _, operation := range operations {
+			if operation.Op == "delete" {
+				if operation.ID == "" || seen[operation.ID] {
+					return false
+				}
+				seen[operation.ID] = true
+				index, exists := positions[operation.ID]
+				if !exists {
+					return false
+				}
+				values = append(values[:index], values[index+1:]...)
+				positions = make(map[string]int, len(values))
+				for position, value := range values {
+					positions[value.ID] = position
+				}
+				continue
+			}
+			if operation.Op != "upsert" {
+				return false
+			}
+			var event protocol.Event
+			if err := json.Unmarshal(operation.Item, &event); err != nil || event.ID == "" || event.Version < 0 || seen[event.ID] {
+				return false
+			}
+			seen[event.ID] = true
+			if index, exists := positions[event.ID]; exists {
+				current := values[index]
+				if event.Version <= current.Version {
+					return false
+				}
+				values[index] = event
+			} else {
+				positions[event.ID] = len(values)
+				values = append(values, event)
+			}
+		}
+		m.snapshot.Events = values
+		return true
+	}
+
+	values := append([]map[string]any(nil), m.snapshot.Vulnerabilities...)
+	positions := make(map[string]int, len(values))
+	for index, finding := range values {
+		positions[collectionItemID(finding)] = index
+	}
+	for _, operation := range operations {
+		if operation.Op == "delete" {
+			if operation.ID == "" || seen[operation.ID] {
+				return false
+			}
+			seen[operation.ID] = true
+			index, exists := positions[operation.ID]
+			if !exists {
+				return false
+			}
+			values = append(values[:index], values[index+1:]...)
+			positions = make(map[string]int, len(values))
+			for position, value := range values {
+				positions[collectionItemID(value)] = position
+			}
+			continue
+		}
+		if operation.Op != "upsert" {
+			return false
+		}
+		var finding map[string]any
+		if err := json.Unmarshal(operation.Item, &finding); err != nil {
+			return false
+		}
+		id := collectionItemID(finding)
+		if id == "" {
+			return false
+		}
+		if seen[id] {
+			return false
+		}
+		seen[id] = true
+		if index, exists := positions[id]; exists {
+			values[index] = finding
+		} else {
+			positions[id] = len(values)
+			values = append(values, finding)
+		}
+	}
+	m.snapshot.Vulnerabilities = values
+	return true
+}
+
+func collectionItemID(item map[string]any) string {
+	id, _ := item["id"].(string)
+	return id
+}
+
+func (m *Model) refreshAfterCollection(name string) tea.Cmd {
+	if name == "agents" {
+		m.ensureAgentVisible()
+		m.refreshViewport()
+		return m.notifyBudgetPause()
+	}
+	if name == "events" {
+		m.refreshViewport()
+		return nil
+	}
+	m.selectedVuln = min(m.selectedVuln, max(0, len(m.snapshot.Vulnerabilities)-1))
+	m.ensureVulnerabilityVisible()
+	m.resizeVulnerabilityViewport()
+	return nil
+}
+
+// notifyBudgetPause ports _notify_budget_pause: a one-shot warning toast when
+// any agent hits the budget limit, re-armed once no agent is paused.
+func (m *Model) notifyBudgetPause() tea.Cmd {
+	paused := false
+	for _, agent := range m.snapshot.Agents {
+		if agent.Status == "budget_paused" {
+			paused = true
+			break
+		}
+	}
+	if paused && !m.budgetPauseNotified {
+		m.budgetPauseNotified = true
+		return m.showToastFor(
+			"Budget limit reached — agents paused. Send a message to continue "+
+				"(this extends the budget), or ctrl-q to quit.",
+			15*time.Second,
+		)
+	}
+	if !paused {
+		m.budgetPauseNotified = false
+	}
+	return nil
+}
@@ -0,0 +1,118 @@
+package protocol
+
+import "encoding/json"
+
+const Version = 3
+
+var Capabilities = []string{
+	"state-revisions",
+	"collection-deltas",
+	"structured-command-errors",
+	"agents-collection",
+}
+
+type Envelope struct {
+	Version   int             `json:"version"`
+	Type      string          `json:"type"`
+	RequestID string          `json:"request_id,omitempty"`
+	Payload   json.RawMessage `json:"payload"`
+}
+
+type Message struct {
+	ID    string `json:"id"`
+	Text  string `json:"text"`
+	Level string `json:"level"`
+}
+
+type Agent struct {
+	ID           string  `json:"id"`
+	Name         string  `json:"name"`
+	ParentID     *string `json:"parent_id"`
+	Status       string  `json:"status"`
+	ErrorMessage string  `json:"error_message"`
+}
+
+type Event struct {
+	ID        string         `json:"id"`
+	Type      string         `json:"type"`
+	AgentID   string         `json:"agent_id"`
+	Timestamp string         `json:"timestamp"`
+	Version   int            `json:"version"`
+	Data      map[string]any `json:"data"`
+}
+
+type Hello struct {
+	Capabilities []string `json:"capabilities"`
+}
+
+type Snapshot struct {
+	SetupMode           bool             `json:"setup_mode"`
+	ScanStarted         bool             `json:"scan_started"`
+	ScanState           string           `json:"scan_state"`
+	Targets             []string         `json:"targets"`
+	TargetCount         int              `json:"target_count"`
+	WorkingDir          string           `json:"working_dir"`
+	PendingMount        string           `json:"pending_mount"`
+	Instruction         string           `json:"instruction"`
+	ScanMode            string           `json:"scan_mode"`
+	MaxBudgetUSD        *float64         `json:"max_budget_usd"`
+	MaxTurns            int              `json:"max_turns"`
+	ScopeMode           string           `json:"scope_mode"`
+	DiffBase            string           `json:"diff_base"`
+	Model               string           `json:"model"`
+	ModelWarning        string           `json:"model_warning"`
+	CaidoURL            string           `json:"caido_url"`
+	Messages            []Message        `json:"messages"`
+	Agents              []Agent          `json:"-"`
+	Events              []Event          `json:"-"`
+	Vulnerabilities     []map[string]any `json:"-"`
+	Usage               map[string]any   `json:"usage"`
+	Subscription        bool             `json:"subscription"`
+	ViewerStatus        string           `json:"viewer_status"`
+	ViewerURL           *string          `json:"viewer_url"`
+	Error               *string          `json:"error"`
+	ProjectionTruncated bool             `json:"projection_truncated"`
+}
+
+type StateUpdate struct {
+	Revision int      `json:"revision"`
+	State    Snapshot `json:"state"`
+}
+
+type CollectionBootstrap struct {
+	Collection string            `json:"collection"`
+	Revision   int               `json:"revision"`
+	Cursor     int               `json:"cursor"`
+	NextCursor int               `json:"next_cursor"`
+	Done       bool              `json:"done"`
+	Items      []json.RawMessage `json:"items"`
+}
+
+type CollectionOperation struct {
+	Op   string          `json:"op"`
+	ID   string          `json:"id,omitempty"`
+	Item json.RawMessage `json:"item"`
+}
+
+type CollectionDelta struct {
+	Collection   string                `json:"collection"`
+	BaseRevision int                   `json:"base_revision"`
+	Revision     int                   `json:"revision"`
+	Cursor       int                   `json:"cursor"`
+	NextCursor   int                   `json:"next_cursor"`
+	Done         bool                  `json:"done"`
+	Operations   []CollectionOperation `json:"operations"`
+}
+
+type CommandError struct {
+	Code      string `json:"code"`
+	Message   string `json:"message"`
+	Retryable bool   `json:"retryable"`
+}
+
+type CommandResult struct {
+	OK      bool            `json:"ok"`
+	Command string          `json:"command"`
+	Result  json.RawMessage `json:"result"`
+	Error   *CommandError   `json:"error"`
+}
@@ -0,0 +1,22 @@
+package protocol
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestProtocolVersionAndCapabilities(t *testing.T) {
+	if Version != 3 {
+		t.Fatalf("protocol version = %d, want 3", Version)
+	}
+	wantCapabilities := []string{
+		"state-revisions",
+		"collection-deltas",
+		"structured-command-errors",
+		"agents-collection",
+	}
+	if !reflect.DeepEqual(Capabilities, wantCapabilities) {
+		t.Fatalf("capabilities = %#v, want %#v", Capabilities, wantCapabilities)
+	}
+
+}
@@ -0,0 +1,320 @@
+package render
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+)
+
+// ---------------------------------------------------------------------------
+// Markdown (agent_message_renderer.py)
+// ---------------------------------------------------------------------------
+
+var blankLineRuns = regexp.MustCompile(`\n\s*\n`)
+
+type mdHeader struct {
+	prefix string
+	strip  int
+	style  lipgloss.Style
+}
+
+var mdHeaders = []mdHeader{
+	{"###### ", 7, Bold(Field)},
+	{"##### ", 6, Bold(Green)},
+	{"#### ", 5, Bold(Hdr16a)},
+	{"### ", 4, Bold(Hdr158)},
+	{"## ", 3, Bold(Green)},
+	{"# ", 2, Bold(Field)},
+}
+
+// renderAssistantMarkdown ports AgentMessageRenderer.render_simple + helpers.
+func renderAssistantMarkdown(content string) string {
+	if content == "" {
+		return ""
+	}
+	cleaned := strings.TrimSpace(blankLineRuns.ReplaceAllString(content, "\n\n"))
+	if cleaned == "" {
+		return ""
+	}
+	return applyMarkdownStyles(cleaned)
+}
+
+func applyMarkdownStyles(text string) string {
+	var out strings.Builder
+	lines := strings.Split(text, "\n")
+
+	inCode := false
+	codeLang := ""
+	var codeLines []string
+
+	flushCode := func() {
+		if len(codeLines) > 0 {
+			out.WriteString(HighlightCode(strings.Join(codeLines, "\n"), codeLang))
+		}
+		codeLines = nil
+		codeLang = ""
+	}
+
+	for i := 0; i < len(lines); i++ {
+		line := lines[i]
+		if i > 0 && !inCode {
+			out.WriteString("\n")
+		}
+
+		if !inCode {
+			if rows := tableRows(lines[i:]); rows > 0 {
+				out.WriteString(renderMarkdownTable(lines[i : i+rows]))
+				i += rows - 1
+				continue
+			}
+		}
+
+		if strings.HasPrefix(line, "```") {
+			if !inCode {
+				inCode = true
+				codeLines = nil
+				codeLang = strings.TrimSpace(strings.TrimPrefix(line, "```"))
+				if i > 0 {
+					out.WriteString("\n")
+				}
+			} else {
+				inCode = false
+				flushCode()
+			}
+			continue
+		}
+
+		if inCode {
+			codeLines = append(codeLines, line)
+			continue
+		}
+
+		if h := tryHeader(line); h != nil {
+			out.WriteString(h.style.Render(line[h.strip:]))
+			continue
+		}
+		switch {
+		case strings.HasPrefix(line, "> "):
+			out.WriteString(Col(Green).Render("┃ ") + inlineFormat(line[2:]))
+		case strings.HasPrefix(line, "- "), strings.HasPrefix(line, "* "):
+			out.WriteString(Col(Green).Render("• ") + inlineFormat(line[2:]))
+		case len(line) > 2 && line[0] >= '0' && line[0] <= '9' && (line[1:3] == ". " || line[1:3] == ") "):
+			out.WriteString(Col(Green).Render(string(line[0])+". ") + inlineFormat(line[2:]))
+		case line == "---" || line == "***" || line == "___":
+			out.WriteString(Col(Green).Render(strings.Repeat("─", 40)))
+		default:
+			out.WriteString(inlineFormat(line))
+		}
+	}
+
+	if inCode && len(codeLines) > 0 {
+		flushCode()
+	}
+	return out.String()
+}
+
+func isTableRow(line string) bool {
+	trimmed := strings.TrimSpace(line)
+	return strings.HasPrefix(trimmed, "|") && strings.Count(trimmed, "|") >= 2
+}
+
+var tableSeparatorCell = regexp.MustCompile(`^:?-+:?$`)
+
+func isTableSeparator(line string) bool {
+	if !isTableRow(line) {
+		return false
+	}
+	cells := splitTableRow(line)
+	if len(cells) == 0 {
+		return false
+	}
+	for _, cell := range cells {
+		if !tableSeparatorCell.MatchString(strings.TrimSpace(cell)) {
+			return false
+		}
+	}
+	return true
+}
+
+// tableRows returns how many leading lines form a markdown table (header,
+// separator, then body rows), or 0 when the block is not a table.
+func tableRows(lines []string) int {
+	if len(lines) < 2 || !isTableRow(lines[0]) || !isTableSeparator(lines[1]) {
+		return 0
+	}
+	rows := 2
+	for rows < len(lines) && isTableRow(lines[rows]) && !isTableSeparator(lines[rows]) {
+		rows++
+	}
+	return rows
+}
+
+func splitTableRow(line string) []string {
+	trimmed := strings.TrimSpace(line)
+	trimmed = strings.TrimPrefix(trimmed, "|")
+	trimmed = strings.TrimSuffix(trimmed, "|")
+	cells := strings.Split(trimmed, "|")
+	for i := range cells {
+		cells[i] = strings.TrimSpace(cells[i])
+	}
+	return cells
+}
+
+// renderMarkdownTable draws a column-aligned table: bold header, a rule under
+// it, and inline-formatted body cells.
+func renderMarkdownTable(lines []string) string {
+	headerStyle := func(cell string) string { return Bold(Field).Render(cell) }
+	rows := make([][]string, 0, len(lines)-1)
+	styleCells := func(line string, style func(string) string) []string {
+		cells := splitTableRow(line)
+		for i := range cells {
+			cells[i] = style(cells[i])
+		}
+		return cells
+	}
+	rows = append(rows, styleCells(lines[0], headerStyle))
+	for _, line := range lines[2:] {
+		rows = append(rows, styleCells(line, inlineFormat))
+	}
+
+	widths := make([]int, len(rows[0]))
+	for _, cells := range rows {
+		for i, cell := range cells {
+			if i < len(widths) {
+				widths[i] = max(widths[i], lipgloss.Width(cell))
+			}
+		}
+	}
+
+	formatRow := func(cells []string) string {
+		parts := make([]string, len(widths))
+		for i := range widths {
+			cell := ""
+			if i < len(cells) {
+				cell = cells[i]
+			}
+			parts[i] = cell + strings.Repeat(" ", max(0, widths[i]-lipgloss.Width(cell)))
+		}
+		return strings.TrimRight(strings.Join(parts, Dim().Render(" │ ")), " ")
+	}
+
+	out := []string{formatRow(rows[0])}
+	rule := make([]string, len(widths))
+	for i, width := range widths {
+		rule[i] = strings.Repeat("─", width)
+	}
+	out = append(out, Dim().Render(strings.Join(rule, "─┼─")))
+	for _, cells := range rows[1:] {
+		out = append(out, formatRow(cells))
+	}
+	return strings.Join(out, "\n")
+}
+
+func tryHeader(line string) *mdHeader {
+	for i := range mdHeaders {
+		if strings.HasPrefix(line, mdHeaders[i].prefix) {
+			return &mdHeaders[i]
+		}
+	}
+	return nil
+}
+
+func isWordByte(b byte) bool {
+	return b == '_' || b >= '0' && b <= '9' || b >= 'a' && b <= 'z' || b >= 'A' && b <= 'Z'
+}
+
+// canOpenEmphasis reports whether an emphasis run starting at i (with the
+// given marker width) follows CommonMark-style flanking rules: it must not
+// sit inside a word and must be followed by a non-space.
+func canOpenEmphasis(line string, i, width int) bool {
+	if i > 0 && isWordByte(line[i-1]) {
+		return false
+	}
+	// Underscores appear inside identifiers far more often than as emphasis,
+	// so they only open at a word boundary.
+	if i > 0 && line[i] == '_' && line[i-1] != ' ' && line[i-1] != '\t' {
+		return false
+	}
+	after := i + width
+	return after < len(line) && line[after] != ' ' && line[after] != '\t'
+}
+
+// canCloseEmphasis reports whether an emphasis run ending at end (marker
+// starts at end) is preceded by a non-space and not followed by a word.
+func canCloseEmphasis(line string, end, width int) bool {
+	if end > 0 && (line[end-1] == ' ' || line[end-1] == '\t') {
+		return false
+	}
+	after := end + width
+	return after >= len(line) || !isWordByte(line[after])
+}
+
+// findEmphasisEnd locates the closing marker for an emphasis span opened at
+// i, honoring the flanking rules; returns -1 when the span should be treated
+// as literal text.
+func findEmphasisEnd(line string, i int, marker string) int {
+	from := i + len(marker)
+	for {
+		end := strings.Index(line[from:], marker)
+		if end == -1 {
+			return -1
+		}
+		end += from
+		if end == i+len(marker) {
+			return -1
+		}
+		if canCloseEmphasis(line, end, len(marker)) {
+			return end
+		}
+		from = end + 1
+	}
+}
+
+// inlineFormat ports _process_inline_formatting.
+func inlineFormat(line string) string {
+	var out strings.Builder
+	i, n := 0, len(line)
+	for i < n {
+		if i+1 < n && (line[i:i+2] == "**" || line[i:i+2] == "__") {
+			marker := line[i : i+2]
+			if canOpenEmphasis(line, i, 2) {
+				if end := findEmphasisEnd(line, i, marker); end != -1 {
+					out.WriteString(Bold(Field).Render(line[i+2 : end]))
+					i = end + 2
+					continue
+				}
+			}
+		}
+		if i+1 < n && line[i:i+2] == "~~" {
+			if canOpenEmphasis(line, i, 2) {
+				if end := findEmphasisEnd(line, i, "~~"); end != -1 {
+					out.WriteString(lipgloss.NewStyle().Strikethrough(true).Foreground(Strike).Render(line[i+2 : end]))
+					i = end + 2
+					continue
+				}
+			}
+		}
+		if line[i] == '`' {
+			if end := strings.Index(line[i+1:], "`"); end != -1 {
+				end += i + 1
+				out.WriteString(lipgloss.NewStyle().Bold(true).Foreground(Green).Background(CodeBg).Render(line[i+1 : end]))
+				i = end + 1
+				continue
+			}
+		}
+		if line[i] == '*' || line[i] == '_' {
+			marker := string(line[i])
+			if i+1 < n && line[i+1] != line[i] && canOpenEmphasis(line, i, 1) {
+				if end := findEmphasisEnd(line, i, marker); end != -1 && (end+1 >= n || line[end+1] != line[i]) {
+					out.WriteString(lipgloss.NewStyle().Italic(true).Foreground(Mint).Render(line[i+1 : end]))
+					i = end + 1
+					continue
+				}
+			}
+		}
+		out.WriteByte(line[i])
+		i++
+	}
+	return out.String()
+}
@@ -0,0 +1,86 @@
+package render
+
+import (
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+)
+
+// ---------------------------------------------------------------------------
+// Agents graph (agents_graph_renderer.py)
+// ---------------------------------------------------------------------------
+
+func renderAgentGraphTool(name string, args map[string]any, result any) string {
+	var b strings.Builder
+	switch name {
+	case "view_agent_graph":
+		b.WriteString(Col(Lavender).Render("◇ ") + Dim().Render("viewing agents graph"))
+	case "create_agent":
+		agentName := StringValue(args["name"])
+		if agentName == "" {
+			agentName = "Agent"
+		}
+		b.WriteString(Col(Lavender).Render("◈ ") + Dim().Render("spawning ") + Bold(Lavender).Render(agentName))
+		if task := StringValue(args["task"]); task != "" {
+			b.WriteString("\n  " + Dim().Render(task))
+		}
+	case "send_message_to_agent":
+		b.WriteString(Col(InfoBlue).Render("→ "))
+		if target := StringValue(args["target_agent_id"]); target != "" {
+			b.WriteString(Dim().Render("to " + target))
+		} else {
+			b.WriteString(Dim().Render("sending message"))
+		}
+		if msg := StringValue(args["message"]); msg != "" {
+			b.WriteString("\n  " + Dim().Render(msg))
+		}
+	case "agent_finish":
+		success := true
+		if v, ok := args["success"].(bool); ok {
+			success = v
+		}
+		if success {
+			b.WriteString(Col(Green).Render("◆ ") + Bold(Green).Render("Agent completed"))
+		} else {
+			b.WriteString(Col(Red).Render("◆ ") + Bold(Red).Render("Agent failed"))
+		}
+		if summary := StringValue(args["result_summary"]); summary != "" {
+			b.WriteString("\n  " + lipgloss.NewStyle().Bold(true).Render(summary))
+			if findings, ok := args["findings"].([]any); ok {
+				for _, f := range findings {
+					b.WriteString("\n  • " + Dim().Render(StringValue(f)))
+				}
+			}
+		} else {
+			b.WriteString("\n  " + Dim().Render("Completing task..."))
+		}
+	case "wait_for_agents":
+		b.WriteString(Col(Gray).Render("○ ") + Dim().Render("waiting"))
+		if reason := StringValue(args["reason"]); reason != "" {
+			b.WriteString("\n  " + Dim().Render(reason))
+		}
+	case "stop_agent":
+		b.WriteString(Col(Red).Render("◼ ") + Dim().Render("stopping"))
+		if target := StringValue(args["target_agent_id"]); target != "" {
+			b.WriteString(Bold(Red).Render(" " + target))
+		}
+		cascade := true
+		if v, ok := args["cascade"].(bool); ok {
+			cascade = v
+		}
+		if cascade {
+			b.WriteString(Dim().Italic(true).Render(" + descendants"))
+		}
+		if reason := StringValue(args["reason"]); reason != "" {
+			b.WriteString("\n  " + Dim().Render(reason))
+		}
+		if m, ok := result.(map[string]any); ok {
+			if s, hs := m["success"].(bool); hs && !s {
+				if e := StringValue(m["error"]); e != "" {
+					b.WriteString("\n  " + Col(Red).Render(e))
+				}
+			}
+		}
+	}
+	return b.String()
+}
@@ -0,0 +1,32 @@
+package render
+
+import (
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+)
+
+// ---------------------------------------------------------------------------
+// Chat messages
+// ---------------------------------------------------------------------------
+
+// renderUserMessage ports UserMessageRenderer._format_user_message.
+func renderUserMessage(content string) string {
+	bar := Col(Blue).Render("▍")
+	var b strings.Builder
+	b.WriteString(bar + " " + lipgloss.NewStyle().Bold(true).Render("You:"))
+	for _, line := range strings.Split(content, "\n") {
+		b.WriteString("\n" + bar + " " + line)
+	}
+	return b.String()
+}
+
+// renderChat renders a chat event (assistant markdown or user message).
+func Chat(data map[string]any) string {
+	role, _ := data["role"].(string)
+	content := StripControls(StringValue(data["content"]))
+	if role == "user" {
+		return renderUserMessage(content)
+	}
+	return renderAssistantMarkdown(content)
+}
@@ -0,0 +1,70 @@
+package render
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/alecthomas/chroma/v2"
+	"github.com/alecthomas/chroma/v2/formatters"
+	"github.com/alecthomas/chroma/v2/lexers"
+	"github.com/alecthomas/chroma/v2/styles"
+)
+
+// HighlightCode ports the Python renderers' pygments highlighting: colorize
+// code for the terminal using the "native" style, falling back to the plain
+// text when the language is unknown or the highlighter fails.
+func HighlightCode(code, language string) string {
+	if strings.TrimSpace(code) == "" {
+		return code
+	}
+	var lexer chroma.Lexer
+	if language != "" {
+		lexer = lexers.Get(language)
+	}
+	if lexer == nil {
+		lexer = lexers.Analyse(code)
+	}
+	if lexer == nil {
+		return Col(Text).Render(code)
+	}
+	lexer = chroma.Coalesce(lexer)
+	style := styles.Get("native")
+	formatter := formatters.Get("terminal256")
+	iterator, err := lexer.Tokenise(nil, code)
+	if err != nil {
+		return Col(Text).Render(code)
+	}
+	var out strings.Builder
+	if err := formatter.Format(&out, style, iterator); err != nil {
+		return Col(Text).Render(code)
+	}
+	return strings.TrimSuffix(out.String(), "\n")
+}
+
+// languageForPath resolves a chroma language name from a file path, returning
+// "" when the extension is unknown.
+func languageForPath(path string) string {
+	if path == "" {
+		return ""
+	}
+	lexer := lexers.Match(filepath.Base(path))
+	if lexer == nil {
+		return ""
+	}
+	return lexer.Config().Name
+}
+
+// ParseFencedCode ports parse_fenced_code: strip a surrounding ``` fence and
+// return the declared language (if any) and the inner code.
+func ParseFencedCode(raw string) (language, code string) {
+	trimmed := strings.TrimSpace(raw)
+	if !strings.HasPrefix(trimmed, "```") {
+		return "", raw
+	}
+	lines := strings.Split(trimmed, "\n")
+	if len(lines) < 2 || strings.TrimSpace(lines[len(lines)-1]) != "```" {
+		return "", raw
+	}
+	language = strings.TrimSpace(strings.TrimPrefix(lines[0], "```"))
+	return language, strings.Join(lines[1:len(lines)-1], "\n")
+}
@@ -0,0 +1,105 @@
+package render
+
+import (
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+)
+
+func renderDependencyReport(args map[string]any, result any) string {
+	resultMap, _ := result.(map[string]any)
+	// Unsuccessful / not-persisted variants.
+	if resultMap != nil {
+		success, hasSuccess := resultMap["success"].(bool)
+		warning := StringValue(resultMap["warning"])
+		if (hasSuccess && !success) || warning != "" {
+			return renderDependencyUnsuccessful(args, resultMap)
+		}
+	}
+	var b strings.Builder
+	b.WriteString("📦 " + Bold(ReportHdr).Render("Dependency (SCA) Report"))
+	field := func(label, value string) {
+		if value != "" {
+			b.WriteString("\n\n" + Bold(Field).Render(label+": ") + value)
+		}
+	}
+	title := StringValue(args["title"])
+	field("Title", title)
+	if sev := StringValue(resultMap["severity"]); sev != "" {
+		b.WriteString("\n\n" + Bold(Field).Render("Severity: ") +
+			lipgloss.NewStyle().Bold(true).Foreground(SeverityColor(sev)).Render(strings.ToUpper(sev)))
+	}
+	if score, ok := NumericValue(args["advisory_cvss"]); ok {
+		b.WriteString("\n\n" + Bold(Field).Render("Advisory CVSS: ") +
+			lipgloss.NewStyle().Bold(true).Foreground(CVSSColor(score)).Render(StringValue(args["advisory_cvss"])))
+	}
+	field("CVE", StringValue(args["cve"]))
+	field("CWE", StringValue(args["cwe"]))
+	if pkg := StringValue(args["package_name"]); pkg != "" {
+		b.WriteString("\n\n" + Bold(Field).Render("Package: ") + Bold(InfoBlue).Render(pkg))
+		if eco := StringValue(args["package_ecosystem"]); eco != "" {
+			b.WriteString(Dim().Render(" (" + eco + ")"))
+		}
+	}
+	if inst := StringValue(args["installed_version"]); inst != "" {
+		b.WriteString("\n\n" + Bold(Field).Render("Installed: ") + Col(Red).Render(inst))
+		if fixed := StringValue(args["fixed_version"]); fixed != "" {
+			b.WriteString(Dim().Render("  →  ") + Bold(Field).Render("Fixed: ") + Col(Green).Render(fixed))
+		}
+	}
+	field("Fix Effort", StringValue(args["fix_effort"]))
+	field("Target", StringValue(args["target"]))
+	section := func(label, value string) {
+		if value != "" {
+			b.WriteString("\n\n" + Bold(Field).Render(label) + "\n" + value)
+		}
+	}
+	section("Description", StringValue(args["description"]))
+	section("Impact", StringValue(args["impact"]))
+	section("Technical Analysis", StringValue(args["technical_analysis"]))
+	if reach := StringValue(args["reachability"]); reach != "" && reach != "unknown" {
+		b.WriteString("\n\n" + Bold(Field).Render("Usage evidence: ") + reach)
+		if ev := StringValue(args["reachability_evidence"]); ev != "" {
+			b.WriteString("\n" + ev)
+		}
+	}
+	section("Assumptions", StringValue(args["assumptions"]))
+	section("Remediation", StringValue(args["remediation_steps"]))
+	if title == "" {
+		b.WriteString("\n  " + Dim().Render("Creating dependency report..."))
+	}
+	return "\n\n" + b.String() + "\n\n"
+}
+
+func renderDependencyUnsuccessful(args, result map[string]any) string {
+	var b strings.Builder
+	b.WriteString("📦 " + Bold(ReportHdr).Render("Dependency (SCA) Report"))
+	if title := StringValue(args["title"]); title != "" {
+		b.WriteString("\n\n" + Bold(Field).Render("Title: ") + title)
+	}
+	success, hasSuccess := result["success"].(bool)
+	var label, detail string
+	var style lipgloss.Style
+	if hasSuccess && !success {
+		detail = StringValue(result["error"])
+		if errs, ok := result["errors"].([]any); ok && len(errs) > 0 {
+			var parts []string
+			for _, e := range errs {
+				parts = append(parts, StringValue(e))
+			}
+			detail = strings.Join(parts, "; ")
+		}
+		label, style = "✗ Not created: ", Bold(SevCrit)
+		if detail == "" {
+			detail = "Report was not created."
+		}
+	} else {
+		detail = StringValue(result["warning"])
+		label, style = "⚠ Not persisted: ", Bold(SevMed)
+		if detail == "" {
+			detail = "Report could not be persisted."
+		}
+	}
+	b.WriteString("\n\n" + style.Render(label) + detail)
+	return "\n\n" + b.String() + "\n\n"
+}
@@ -0,0 +1,143 @@
+package render
+
+import (
+	"strings"
+)
+
+// ---------------------------------------------------------------------------
+// Filesystem: apply_patch + view_image (filesystem_renderer.py)
+// ---------------------------------------------------------------------------
+
+const (
+	addFilePfx    = "*** Add File: "
+	deleteFilePfx = "*** Delete File: "
+	updateFilePfx = "*** Update File: "
+	beginPatch    = "*** Begin Patch"
+	endPatch      = "*** End Patch"
+)
+
+type patchOp struct {
+	kind string
+	path string
+	old  []string
+	new  []string
+}
+
+func extractPatchText(args map[string]any) string {
+	if raw, ok := args["patch"].(string); ok {
+		return raw
+	}
+	if raw, ok := args["patch"].(map[string]any); ok {
+		if inner, ok := raw["patch"].(string); ok {
+			return inner
+		}
+	}
+	if fb, ok := args["input"].(string); ok {
+		return fb
+	}
+	return ""
+}
+
+func parsePatchOperations(patch string) []patchOp {
+	var ops []patchOp
+	var cur *patchOp
+	flush := func() {
+		if cur != nil && cur.kind != "" {
+			ops = append(ops, *cur)
+		}
+		cur = nil
+	}
+	for _, line := range strings.Split(patch, "\n") {
+		switch {
+		case line == beginPatch || line == endPatch:
+			continue
+		case strings.HasPrefix(line, addFilePfx):
+			flush()
+			cur = &patchOp{kind: "add", path: strings.TrimSpace(line[len(addFilePfx):])}
+		case strings.HasPrefix(line, updateFilePfx):
+			flush()
+			cur = &patchOp{kind: "update", path: strings.TrimSpace(line[len(updateFilePfx):])}
+		case strings.HasPrefix(line, deleteFilePfx):
+			flush()
+			cur = &patchOp{kind: "delete", path: strings.TrimSpace(line[len(deleteFilePfx):])}
+		case cur != nil && cur.kind == "update":
+			if strings.HasPrefix(line, "@@") {
+				continue
+			}
+			if strings.HasPrefix(line, "-") && !strings.HasPrefix(line, "---") {
+				cur.old = append(cur.old, line[1:])
+			} else if strings.HasPrefix(line, "+") && !strings.HasPrefix(line, "+++") {
+				cur.new = append(cur.new, line[1:])
+			}
+		case cur != nil && cur.kind == "add":
+			if strings.HasPrefix(line, "+") {
+				cur.new = append(cur.new, line[1:])
+			} else if strings.TrimSpace(line) != "" {
+				cur.new = append(cur.new, line)
+			}
+		}
+	}
+	flush()
+	return ops
+}
+
+var opLabel = map[string]string{"add": "create", "update": "edit", "delete": "delete"}
+
+func renderPatchOperation(b *strings.Builder, op patchOp) {
+	label := opLabel[op.kind]
+	if label == "" {
+		label = "file"
+	}
+	b.WriteString(Col(Emerald).Render("◇ ") + Dim().Render(label))
+	if op.path != "" {
+		p := op.path
+		if len(p) > 60 {
+			p = p[len(p)-60:]
+		}
+		b.WriteString(" " + Dim().Render(p))
+	}
+	lang := languageForPath(op.path)
+	if op.kind == "update" {
+		for _, line := range highlightLines(op.old, lang) {
+			b.WriteString("\n" + Col(Red).Render("-") + " " + line)
+		}
+		for _, line := range highlightLines(op.new, lang) {
+			b.WriteString("\n" + Col(Green).Render("+") + " " + line)
+		}
+	} else if op.kind == "add" && len(op.new) > 0 {
+		b.WriteString("\n" + HighlightCode(strings.Join(op.new, "\n"), lang))
+	}
+}
+
+func highlightLines(lines []string, lang string) []string {
+	if len(lines) == 0 || lang == "" {
+		return lines
+	}
+	return strings.Split(HighlightCode(strings.Join(lines, "\n"), lang), "\n")
+}
+
+func renderApplyPatch(args map[string]any, result any, status string) string {
+	ops := parsePatchOperations(extractPatchText(args))
+	var b strings.Builder
+	if len(ops) == 0 {
+		b.WriteString(Col(Emerald).Render("◇ ") + Dim().Render("patch"))
+		if s, ok := result.(string); ok && strings.TrimSpace(s) != "" {
+			b.WriteString("\n  " + Dim().Render(strings.TrimSpace(s)))
+		} else if result == nil {
+			b.WriteString(" " + Dim().Render("Processing..."))
+		}
+		return b.String()
+	}
+	for i, op := range ops {
+		if i > 0 {
+			b.WriteString("\n")
+		}
+		renderPatchOperation(&b, op)
+	}
+	if status == "failed" {
+		if s, ok := result.(string); ok && strings.TrimSpace(s) != "" {
+			b.WriteString("\n  " + Col(Red).Render(strings.TrimSpace(s)))
+		}
+	}
+	return b.String()
+}
@@ -0,0 +1,112 @@
+package render
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// ---------------------------------------------------------------------------
+// small helpers
+// ---------------------------------------------------------------------------
+
+func truthy(v any) bool {
+	switch x := v.(type) {
+	case bool:
+		return x
+	case string:
+		return x != ""
+	case float64:
+		return x != 0
+	case nil:
+		return false
+	}
+	return v != nil
+}
+
+func NumericValue(v any) (float64, bool) {
+	switch x := v.(type) {
+	case float64:
+		return x, true
+	case int:
+		return float64(x), true
+	case int64:
+		return float64(x), true
+	}
+	return 0, false
+}
+
+func truncStr(s string, n int) string {
+	if len(s) > n {
+		return s[:n]
+	}
+	return s
+}
+
+func lastN(s string, n int) string {
+	if len(s) > n {
+		return s[len(s)-n:]
+	}
+	return s
+}
+
+func firstN(s string, n int) string {
+	if len(s) > n {
+		return s[:n]
+	}
+	return s
+}
+
+func joinTrunc(items []any, max, limit int) string {
+	shown := items
+	if len(shown) > limit {
+		shown = shown[:limit]
+	}
+	var parts []string
+	for _, it := range shown {
+		parts = append(parts, ptrunc(StringValue(it), max))
+	}
+	return strings.Join(parts, ", ")
+}
+
+// stripControlsKeepTabs drops control bytes except \t and \n (shell cleaning).
+func stripControlsKeepTabs(s string) string {
+	return strings.Map(func(r rune) rune {
+		if r == '\n' || r == '\t' || r >= 32 {
+			return r
+		}
+		return -1
+	}, s)
+}
+
+func StringValue(value any) string {
+	if value == nil {
+		return ""
+	}
+	if text, ok := value.(string); ok {
+		return text
+	}
+	raw, err := json.Marshal(value)
+	if err == nil {
+		return string(raw)
+	}
+	return fmt.Sprint(value)
+}
+func StripControls(value string) string {
+	return strings.Map(func(r rune) rune {
+		if r == '\n' || r == '\t' || r >= 32 {
+			return r
+		}
+		return -1
+	}, value)
+}
+
+func SortedKeys(values map[string]any) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
@@ -0,0 +1,106 @@
+package render
+
+import (
+	"strings"
+)
+
+func renderViewImage(args map[string]any, result any) string {
+	path := strings.TrimSpace(StringValue(args["path"]))
+	var b strings.Builder
+	b.WriteString(Col(Emerald).Render("◇ ") + Dim().Render("view image"))
+	if path != "" {
+		if len(path) > 60 {
+			path = path[len(path)-60:]
+		}
+		b.WriteString(" " + Dim().Render(path))
+	}
+	if s, ok := result.(string); ok {
+		low := strings.ToLower(strings.TrimSpace(s))
+		if strings.HasPrefix(low, "image path ") || strings.HasPrefix(low, "unable to read image") ||
+			strings.HasPrefix(low, "manifest path") || strings.HasPrefix(low, "exceeded the allowed size") ||
+			strings.Contains(low, "not a supported image") {
+			b.WriteString("\n  " + Col(Red).Render(strings.TrimSpace(s)))
+			return b.String()
+		}
+	}
+	if isImageSuccess(result) {
+		b.WriteString("  " + Col(Green).Render("✓"))
+		if KittyGraphicsSupported() {
+			if mime, payload := extractImageDataURI(result); mime != "" {
+				if block := kittyImageBlock(mime, payload); block != "" {
+					b.WriteString("\n" + block)
+				}
+			}
+		}
+	}
+	return b.String()
+}
+
+var imageMimes = []string{"png", "jpeg", "jpg", "gif", "webp"}
+
+func isBase64Byte(b byte) bool {
+	return b >= 'A' && b <= 'Z' || b >= 'a' && b <= 'z' || b >= '0' && b <= '9' ||
+		b == '+' || b == '/' || b == '='
+}
+
+// parseImageDataURI scans a data URI without a regexp: payloads run to
+// megabytes and the regexp engine is far too slow to walk them per frame.
+func parseImageDataURI(s string) (mime, payload string) {
+	start := strings.Index(s, "data:image/")
+	if start < 0 {
+		return "", ""
+	}
+	rest := s[start+len("data:image/"):]
+	for _, candidate := range imageMimes {
+		if !strings.HasPrefix(rest, candidate+";base64,") {
+			continue
+		}
+		data := rest[len(candidate)+len(";base64,"):]
+		end := len(data)
+		for i := range len(data) {
+			if !isBase64Byte(data[i]) {
+				end = i
+				break
+			}
+		}
+		if candidate == "jpg" {
+			candidate = "jpeg"
+		}
+		return candidate, data[:end]
+	}
+	return "", ""
+}
+
+// extractImageDataURI pulls a base64 image payload out of a view_image tool
+// result: a raw data URI or a structured map with an image_url/url field.
+func extractImageDataURI(result any) (mime, payload string) {
+	var s string
+	switch v := result.(type) {
+	case string:
+		s = v
+	case map[string]any:
+		if u := StringValue(v["image_url"]); u != "" {
+			s = u
+		} else if u := StringValue(v["url"]); u != "" {
+			s = u
+		}
+	}
+	if s == "" {
+		return "", ""
+	}
+	mime, payload = parseImageDataURI(s)
+	if mime == "" || len(payload) < 100 || len(payload)%4 != 0 {
+		return "", ""
+	}
+	return mime, payload
+}
+
+func isImageSuccess(result any) bool {
+	if m, ok := result.(map[string]any); ok {
+		return StringValue(m["type"]) == "image"
+	}
+	if s, ok := result.(string); ok {
+		return strings.HasPrefix(strings.TrimLeft(s, " \t\n"), "data:image/")
+	}
+	return false
+}
@@ -0,0 +1,139 @@
+package render
+
+import (
+	"bytes"
+	"os"
+	"time"
+
+	"github.com/charmbracelet/x/term"
+)
+
+// queryBudget bounds the whole capability exchange. A terminal answers in
+// microseconds; anything this slow is not going to answer at all.
+const queryBudget = 500 * time.Millisecond
+
+// drainBudget is the grace period spent collecting whatever else the terminal
+// sent after the answer we were looking for.
+const drainBudget = 50 * time.Millisecond
+
+// etx is what ctrl-c delivers while ISIG is cleared.
+const etx = 0x03
+
+// DetectKittyGraphics asks the terminal whether it supports the kitty
+// graphics protocol, the way kitty's own tooling does: send a 1x1 query
+// (a=q) followed by a Primary Device Attributes request, then read until the
+// DA1 response arrives. A graphics-capable terminal answers the query with an
+// APC "OK" response before the DA1; anything else ignores it. Must run before
+// Bubble Tea takes over stdin.
+func DetectKittyGraphics() {
+	supported, interrupted := queryKittyGraphics(os.Stdin, os.Stdout)
+	KittyGraphicsSupported = func() bool { return supported }
+	if interrupted {
+		// The query runs with ISIG cleared, so ctrl-c arrives as a byte instead
+		// of a signal. Raise it now that the terminal is restored, so a ctrl-c
+		// during startup quits rather than being swallowed.
+		interruptSelf()
+	}
+}
+
+func queryKittyGraphics(in, out *os.File) (supported, interrupted bool) {
+	fd := int(in.Fd())
+	if !term.IsTerminal(uintptr(fd)) {
+		return false, false
+	}
+	oldState, err := term.MakeRaw(uintptr(fd))
+	if err != nil {
+		return false, false
+	}
+	// Everything the terminal sends must be consumed before the terminal echoes
+	// it: once cooked mode is back, a reply still in flight is printed to the
+	// screen as mojibake like "^[[?62;52;c".
+	defer term.Restore(uintptr(fd), oldState) //nolint:errcheck
+
+	// The same 1x1 RGB query used by viuer and yazi; DA1 (CSI c) is answered
+	// by every terminal and bounds the read.
+	if _, err := out.WriteString("\x1b_Gi=31,s=1,v=1,a=q,t=d,f=24;AAAA\x1b\\\x1b[c"); err != nil {
+		return false, false
+	}
+
+	reply := readCapabilityReply(in, queryBudget)
+	if reply.answered {
+		// The kitty answer arrives before the DA1, so the DA1 is still on its
+		// way. Take it now rather than leaving it for the shell to echo.
+		drainInput(in, drainBudget)
+	}
+	return reply.supported, reply.interrupted
+}
+
+// capabilityReply is what the terminal told us: whether it supports the
+// protocol, whether it answered at all, and whether the user pressed ctrl-c
+// while we were waiting.
+type capabilityReply struct {
+	supported   bool
+	answered    bool
+	interrupted bool
+}
+
+// readCapabilityReply reads until the kitty answer or the DA1 that follows it,
+// whichever comes first.
+func readCapabilityReply(in *os.File, budget time.Duration) capabilityReply {
+	deadline := time.Now().Add(budget)
+	var buf bytes.Buffer
+	chunk := make([]byte, 256)
+	for {
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			return capabilityReply{}
+		}
+		// The read itself has to be bounded. os.File deadlines do not work on a
+		// terminal - the fd is blocking, so it is never registered with the
+		// runtime poller and SetReadDeadline fails with "file type does not
+		// support deadline" - which would leave this read hanging until the
+		// terminal happened to send something.
+		ready, err := waitReadable(in, remaining)
+		if err != nil || !ready {
+			return capabilityReply{}
+		}
+		n, err := in.Read(chunk)
+		if n > 0 {
+			buf.Write(chunk[:n])
+			// ctrl-c is ETX here rather than a signal. Stop waiting on the
+			// terminal the moment the user asks to leave.
+			if bytes.IndexByte(buf.Bytes(), etx) >= 0 {
+				return capabilityReply{interrupted: true}
+			}
+			if apc := bytes.Index(buf.Bytes(), []byte("\x1b_G")); apc >= 0 &&
+				bytes.Contains(buf.Bytes()[apc:], []byte(";OK")) {
+				return capabilityReply{supported: true, answered: true}
+			}
+			// DA1 response: ESC [ ? ... c
+			if idx := bytes.Index(buf.Bytes(), []byte("\x1b[?")); idx >= 0 &&
+				bytes.IndexByte(buf.Bytes()[idx:], 'c') >= 0 {
+				return capabilityReply{answered: true}
+			}
+		}
+		if err != nil {
+			return capabilityReply{}
+		}
+	}
+}
+
+// drainInput consumes whatever is already readable, so no part of the terminal's
+// answer survives into cooked mode.
+func drainInput(in *os.File, budget time.Duration) {
+	deadline := time.Now().Add(budget)
+	chunk := make([]byte, 256)
+	for {
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			return
+		}
+		ready, err := waitReadable(in, remaining)
+		if err != nil || !ready {
+			return
+		}
+		if _, err := in.Read(chunk); err != nil {
+			return
+		}
+	}
+}
@@ -0,0 +1,133 @@
+//go:build !windows
+
+package render
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// A terminal that ignores the query must not stall startup. This is the bound
+// that os.File read deadlines could not provide: a tty descriptor is blocking,
+// so it is never registered with the runtime poller and SetReadDeadline fails
+// with "file type does not support deadline", leaving the read to hang until the
+// terminal happened to send something.
+func TestCapabilityReadGivesUpOnASilentTerminal(t *testing.T) {
+	reader, writer := pipePair(t)
+	defer writer.Close()
+
+	start := time.Now()
+	reply := readCapabilityReply(reader, 150*time.Millisecond)
+
+	if reply.supported || reply.answered {
+		t.Fatalf("silence reported an answer: %+v", reply)
+	}
+	if elapsed := time.Since(start); elapsed > 3*time.Second {
+		t.Fatalf("the read was not bounded: %s", elapsed)
+	}
+}
+
+func TestCapabilityReadClassifiesTheReply(t *testing.T) {
+	for _, testCase := range []struct {
+		name  string
+		reply string
+		want  bool
+	}{
+		{"DA1 alone means no kitty support", "\x1b[?62;52;c", false},
+		{"a kitty answer means support", "\x1b_Gi=31;OK\x1b\\\x1b[?62;52;c", true},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			reader, writer := pipePair(t)
+			defer writer.Close()
+			if _, err := writer.WriteString(testCase.reply); err != nil {
+				t.Fatalf("write reply: %v", err)
+			}
+
+			reply := readCapabilityReply(reader, time.Second)
+
+			if !reply.answered {
+				t.Fatal("a reply was sent but not seen")
+			}
+			if reply.supported != testCase.want {
+				t.Fatalf("support = %v, want %v", reply.supported, testCase.want)
+			}
+		})
+	}
+}
+
+// The DA1 trails a kitty answer, so it is still arriving when the answer is
+// recognized. Anything left unread is echoed to the screen once cooked mode
+// returns, which is where "^[[?62;52;c" came from.
+func TestDrainClearsWhatFollowsTheAnswer(t *testing.T) {
+	reader, writer := pipePair(t)
+	defer writer.Close()
+	if _, err := writer.WriteString("\x1b_Gi=31;OK\x1b\\\x1b[?62;52;c"); err != nil {
+		t.Fatalf("write reply: %v", err)
+	}
+
+	reply := readCapabilityReply(reader, time.Second)
+	if !reply.supported || !reply.answered {
+		t.Fatalf("kitty answer not recognized: %+v", reply)
+	}
+	drainInput(reader, drainBudget)
+
+	leftover, err := waitReadable(reader, 100*time.Millisecond)
+	if err != nil {
+		t.Fatalf("leftover check failed: %v", err)
+	}
+	if leftover {
+		t.Fatal("part of the reply survived the drain and would be echoed")
+	}
+}
+
+// The query clears ISIG, so ctrl-c arrives as ETX rather than a signal. It has to
+// end the wait instead of being swallowed as terminal noise, which is what left a
+// hung startup unresponsive to ctrl-c.
+func TestCtrlCEndsTheWait(t *testing.T) {
+	reader, writer := pipePair(t)
+	defer writer.Close()
+	if _, err := writer.Write([]byte{etx}); err != nil {
+		t.Fatalf("write ctrl-c: %v", err)
+	}
+
+	start := time.Now()
+	reply := readCapabilityReply(reader, 10*time.Second)
+
+	if !reply.interrupted {
+		t.Fatalf("ctrl-c was not recognized: %+v", reply)
+	}
+	if reply.answered || reply.supported {
+		t.Fatalf("ctrl-c must not be read as a terminal answer: %+v", reply)
+	}
+	if elapsed := time.Since(start); elapsed > 2*time.Second {
+		t.Fatalf("ctrl-c did not end the wait promptly: %s", elapsed)
+	}
+}
+
+// waitReadable must report readiness without waiting out the whole timeout.
+func TestWaitReadableSeesAvailableInput(t *testing.T) {
+	reader, writer := pipePair(t)
+	defer writer.Close()
+	if _, err := writer.WriteString("x"); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	ready, err := waitReadable(reader, time.Second)
+	if err != nil {
+		t.Fatalf("waitReadable failed: %v", err)
+	}
+	if !ready {
+		t.Fatal("input was available but waitReadable reported none")
+	}
+}
+
+func pipePair(t *testing.T) (reader, writer *os.File) {
+	t.Helper()
+	reader, writer, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	t.Cleanup(func() { reader.Close() })
+	return reader, writer
+}
@@ -0,0 +1,37 @@
+//go:build !windows
+
+package render
+
+import (
+	"os"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// waitReadable reports whether the descriptor has input available within the
+// timeout. poll(2) works on a blocking terminal descriptor, which is what a tty
+// is and why os.File read deadlines cannot be used here.
+func waitReadable(in *os.File, timeout time.Duration) (bool, error) {
+	fds := []unix.PollFd{{Fd: int32(in.Fd()), Events: unix.POLLIN}}
+	milliseconds := int(timeout.Milliseconds())
+	if milliseconds <= 0 {
+		milliseconds = 1
+	}
+	for {
+		n, err := unix.Poll(fds, milliseconds)
+		if err == unix.EINTR {
+			continue
+		}
+		if err != nil {
+			return false, err
+		}
+		return n > 0, nil
+	}
+}
+
+// interruptSelf raises the interrupt the terminal could not deliver while the
+// capability query held the terminal with signals disabled.
+func interruptSelf() {
+	_ = unix.Kill(os.Getpid(), unix.SIGINT)
+}
@@ -0,0 +1,19 @@
+//go:build windows
+
+package render
+
+import (
+	"os"
+	"time"
+)
+
+// waitReadable has no console equivalent worth carrying: no Windows terminal
+// implements the kitty graphics protocol, so detection reports no support rather
+// than blocking on a reply that never comes.
+func waitReadable(_ *os.File, _ time.Duration) (bool, error) {
+	return false, nil
+}
+
+// interruptSelf has nothing to do: detection never reads on this platform, so
+// ctrl-c is never withheld from the console.
+func interruptSelf() {}
@@ -0,0 +1,202 @@
+package render
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	"image/png"
+	"strings"
+	"sync"
+)
+
+// Native inline images via the kitty graphics protocol with Unicode
+// placeholders (https://sw.kovidgoyal.net/kitty/graphics-protocol/): the image
+// is transmitted once out of band with a virtual placement, and the chat trace
+// renders placeholder cells that the terminal replaces with real pixels. The
+// placeholder rows are plain styled text, so they scroll and diff like any
+// other Bubble Tea content. Terminals without the protocol show no preview.
+
+const (
+	imageMinCols     = 20
+	imageMaxCols     = 100
+	imageDefaultCols = 72
+	imageMaxRows     = 28
+	kittyChunkSize   = 4096
+)
+
+var imageCols = imageDefaultCols
+
+// SetImageWidth sizes inline image placements to the chat content width in cells.
+func SetImageWidth(cells int) {
+	imageCols = min(max(cells, imageMinCols), imageMaxCols)
+}
+
+// KittyGraphicsSupported reports whether the terminal supports the kitty
+// graphics protocol; set at startup by DetectKittyGraphics via a live
+// terminal query.
+var KittyGraphicsSupported = func() bool { return false }
+
+type kittyPlacement struct {
+	id          uint32
+	cols        int
+	rows        int
+	placeholder string
+}
+
+var (
+	kittyMu     sync.Mutex
+	kittyByHash = map[string]kittyPlacement{}
+	kittyQueue  []string
+	kittyNextID uint32 = 1
+)
+
+// DrainImageTransmissions returns queued kitty transmit/placement sequences,
+// to be written directly to the terminal exactly once per image.
+func DrainImageTransmissions() []string {
+	kittyMu.Lock()
+	defer kittyMu.Unlock()
+	out := kittyQueue
+	kittyQueue = nil
+	return out
+}
+
+// payloadKey identifies an image payload without hashing megabytes of base64
+// on every frame: its length plus both ends are enough to tell distinct
+// images apart.
+func payloadKey(payload string) string {
+	const edge = 64
+	if len(payload) <= 2*edge {
+		return payload
+	}
+	return fmt.Sprintf("%d:%s:%s", len(payload), payload[:edge], payload[len(payload)-edge:])
+}
+
+// kittyImageBlock registers the image payload (queueing its transmission on
+// first sight) and returns the styled placeholder block for the chat trace.
+func kittyImageBlock(mime, payload string) string {
+	kittyMu.Lock()
+	defer kittyMu.Unlock()
+	key := payloadKey(payload)
+	placement, ok := kittyByHash[key]
+	if !ok {
+		pngData, w, h := payloadToPNG(mime, payload)
+		if pngData == nil {
+			return ""
+		}
+		cols := min(imageCols, w)
+		rows := (h*cols + w - 1) / (w * 2)
+		rows = min(max(1, rows), imageMaxRows)
+		placement = kittyPlacement{id: kittyNextID, cols: cols, rows: rows}
+		placement.placeholder = kittyPlaceholder(placement)
+		kittyNextID++
+		kittyByHash[key] = placement
+		kittyQueue = append(kittyQueue, kittyTransmit(placement, pngData))
+	}
+	return placement.placeholder
+}
+
+func payloadToPNG(mime, payload string) (data []byte, w, h int) {
+	raw, err := base64.StdEncoding.DecodeString(payload)
+	if err != nil {
+		return nil, 0, 0
+	}
+	img, _, err := image.Decode(bytes.NewReader(raw))
+	if err != nil {
+		return nil, 0, 0
+	}
+	bounds := img.Bounds()
+	if bounds.Dx() <= 0 || bounds.Dy() <= 0 {
+		return nil, 0, 0
+	}
+	if mime == "png" {
+		return raw, bounds.Dx(), bounds.Dy()
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		return nil, 0, 0
+	}
+	return buf.Bytes(), bounds.Dx(), bounds.Dy()
+}
+
+// kittyTransmit builds the chunked APC sequences transmitting the PNG and
+// creating a virtual (U=1) placement for Unicode placeholders.
+func kittyTransmit(p kittyPlacement, pngData []byte) string {
+	encoded := base64.StdEncoding.EncodeToString(pngData)
+	var b strings.Builder
+	first := true
+	for len(encoded) > 0 {
+		chunk := encoded
+		if len(chunk) > kittyChunkSize {
+			chunk = chunk[:kittyChunkSize]
+		}
+		encoded = encoded[len(chunk):]
+		more := 0
+		if len(encoded) > 0 {
+			more = 1
+		}
+		if first {
+			fmt.Fprintf(&b, "\x1b_Ga=t,q=2,f=100,i=%d,m=%d;%s\x1b\\", p.id, more, chunk)
+			first = false
+		} else {
+			fmt.Fprintf(&b, "\x1b_Gm=%d;%s\x1b\\", more, chunk)
+		}
+	}
+	fmt.Fprintf(&b, "\x1b_Ga=p,q=2,U=1,i=%d,c=%d,r=%d\x1b\\", p.id, p.cols, p.rows)
+	return b.String()
+}
+
+// kittyPlaceholder renders the rows x cols grid of U+10EEEE placeholder cells
+// carrying the image id in the foreground color and the cell position in
+// row/column diacritics. The id must reach the terminal as an exact truecolor
+// value, so the SGR sequence is emitted directly rather than through lipgloss
+// (whose profile detection may downsample it).
+func kittyPlaceholder(p kittyPlacement) string {
+	id := p.id & 0xffffff
+	var b strings.Builder
+	for row := range p.rows {
+		if row > 0 {
+			b.WriteString("\n")
+		}
+		fmt.Fprintf(&b, "\x1b[38;2;%d;%d;%dm", id>>16&0xff, id>>8&0xff, id&0xff)
+		for col := range p.cols {
+			b.WriteRune(0x10eeee)
+			b.WriteRune(rowColumnDiacritics[row])
+			b.WriteRune(rowColumnDiacritics[col])
+		}
+		b.WriteString("\x1b[39m")
+	}
+	return b.String()
+}
+
+// rowColumnDiacritics is kitty's canonical placeholder diacritic table
+// (gen/rowcolumn-diacritics.txt); index n encodes row/column number n.
+var rowColumnDiacritics = []rune{
+	0x0305, 0x030D, 0x030E, 0x0310, 0x0312, 0x033D, 0x033E, 0x033F, 0x0346, 0x034A, 0x034B, 0x034C,
+	0x0350, 0x0351, 0x0352, 0x0357, 0x035B, 0x0363, 0x0364, 0x0365, 0x0366, 0x0367, 0x0368, 0x0369,
+	0x036A, 0x036B, 0x036C, 0x036D, 0x036E, 0x036F, 0x0483, 0x0484, 0x0485, 0x0486, 0x0487, 0x0592,
+	0x0593, 0x0594, 0x0595, 0x0597, 0x0598, 0x0599, 0x059C, 0x059D, 0x059E, 0x059F, 0x05A0, 0x05A1,
+	0x05A8, 0x05A9, 0x05AB, 0x05AC, 0x05AF, 0x05C4, 0x0610, 0x0611, 0x0612, 0x0613, 0x0614, 0x0615,
+	0x0616, 0x0617, 0x0657, 0x0658, 0x0659, 0x065A, 0x065B, 0x065D, 0x065E, 0x06D6, 0x06D7, 0x06D8,
+	0x06D9, 0x06DA, 0x06DB, 0x06DC, 0x06DF, 0x06E0, 0x06E1, 0x06E2, 0x06E4, 0x06E7, 0x06E8, 0x06EB,
+	0x06EC, 0x0730, 0x0732, 0x0733, 0x0735, 0x0736, 0x073A, 0x073D, 0x073F, 0x0740, 0x0741, 0x0743,
+	0x0745, 0x0747, 0x0749, 0x074A, 0x07EB, 0x07EC, 0x07ED, 0x07EE, 0x07EF, 0x07F0, 0x07F1, 0x07F3,
+	0x0816, 0x0817, 0x0818, 0x0819, 0x081B, 0x081C, 0x081D, 0x081E, 0x081F, 0x0820, 0x0821, 0x0822,
+	0x0823, 0x0825, 0x0826, 0x0827, 0x0829, 0x082A, 0x082B, 0x082C, 0x082D, 0x0951, 0x0953, 0x0954,
+	0x0F82, 0x0F83, 0x0F86, 0x0F87, 0x135D, 0x135E, 0x135F, 0x17DD, 0x193A, 0x1A17, 0x1A75, 0x1A76,
+	0x1A77, 0x1A78, 0x1A79, 0x1A7A, 0x1A7B, 0x1A7C, 0x1B6B, 0x1B6D, 0x1B6E, 0x1B6F, 0x1B70, 0x1B71,
+	0x1B72, 0x1B73, 0x1CD0, 0x1CD1, 0x1CD2, 0x1CDA, 0x1CDB, 0x1CE0, 0x1DC0, 0x1DC1, 0x1DC3, 0x1DC4,
+	0x1DC5, 0x1DC6, 0x1DC7, 0x1DC8, 0x1DC9, 0x1DCB, 0x1DCC, 0x1DD1, 0x1DD2, 0x1DD3, 0x1DD4, 0x1DD5,
+	0x1DD6, 0x1DD7, 0x1DD8, 0x1DD9, 0x1DDA, 0x1DDB, 0x1DDC, 0x1DDD, 0x1DDE, 0x1DDF, 0x1DE0, 0x1DE1,
+	0x1DE2, 0x1DE3, 0x1DE4, 0x1DE5, 0x1DE6, 0x1DFE, 0x20D0, 0x20D1, 0x20D4, 0x20D5, 0x20D6, 0x20D7,
+	0x20DB, 0x20DC, 0x20E1, 0x20E7, 0x20E9, 0x20F0, 0x2CEF, 0x2CF0, 0x2CF1, 0x2DE0, 0x2DE1, 0x2DE2,
+	0x2DE3, 0x2DE4, 0x2DE5, 0x2DE6, 0x2DE7, 0x2DE8, 0x2DE9, 0x2DEA, 0x2DEB, 0x2DEC, 0x2DED, 0x2DEE,
+	0x2DEF, 0x2DF0, 0x2DF1, 0x2DF2, 0x2DF3, 0x2DF4, 0x2DF5, 0x2DF6, 0x2DF7, 0x2DF8, 0x2DF9, 0x2DFA,
+	0x2DFB, 0x2DFC, 0x2DFD, 0x2DFE, 0x2DFF, 0xA66F, 0xA67C, 0xA67D, 0xA6F0, 0xA6F1, 0xA8E0, 0xA8E1,
+	0xA8E2, 0xA8E3, 0xA8E4, 0xA8E5, 0xA8E6, 0xA8E7, 0xA8E8, 0xA8E9, 0xA8EA, 0xA8EB, 0xA8EC, 0xA8ED,
+	0xA8EE, 0xA8EF, 0xA8F0, 0xA8F1, 0xAAB0, 0xAAB2, 0xAAB3, 0xAAB7, 0xAAB8, 0xAABE, 0xAABF, 0xAAC1,
+	0xFE20, 0xFE21, 0xFE22, 0xFE23, 0xFE24, 0xFE25, 0xFE26, 0x10A0F, 0x10A38, 0x1D185, 0x1D186,
+	0x1D187, 0x1D188, 0x1D189, 0x1D1AA, 0x1D1AB, 0x1D1AC, 0x1D1AD, 0x1D242, 0x1D243, 0x1D244,
+}
@@ -0,0 +1,103 @@
+package render
+
+import (
+	"bytes"
+	"encoding/base64"
+	"image"
+	"image/color"
+	"image/png"
+	"strings"
+	"testing"
+)
+
+func testImageDataURI(t *testing.T, w, h int) string {
+	t.Helper()
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	for y := range h {
+		for x := range w {
+			img.Set(x, y, color.RGBA{R: uint8(255 * x / w), G: uint8(255 * y / h), B: 128, A: 255})
+		}
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatal(err)
+	}
+	return "data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes())
+}
+
+func withKittySupport(t *testing.T, supported bool) {
+	t.Helper()
+	previous := KittyGraphicsSupported
+	KittyGraphicsSupported = func() bool { return supported }
+	t.Cleanup(func() { KittyGraphicsSupported = previous })
+}
+
+func TestViewImageRendersKittyPlaceholders(t *testing.T) {
+	withKittySupport(t, true)
+	uri := testImageDataURI(t, 120, 80)
+	out := Tool(tool("view_image", map[string]any{"path": "/tmp/shot.png"}, uri, "completed"))
+	if !strings.ContainsRune(out, 0x10eeee) {
+		t.Fatalf("expected kitty placeholder cells in render:\n%s", out)
+	}
+
+	transmissions := DrainImageTransmissions()
+	if len(transmissions) != 1 {
+		t.Fatalf("expected one queued transmission, got %d", len(transmissions))
+	}
+	seq := transmissions[0]
+	if !strings.Contains(seq, "\x1b_Ga=t,q=2,f=100,") {
+		t.Fatalf("missing transmit sequence: %.80s", seq)
+	}
+	if !strings.Contains(seq, "a=p,q=2,U=1,") {
+		t.Fatalf("missing virtual placement: %.80s", seq)
+	}
+
+	// Re-rendering the same image must not queue a second transmission.
+	Tool(tool("view_image", map[string]any{"path": "/tmp/shot.png"}, uri, "completed"))
+	if again := DrainImageTransmissions(); len(again) != 0 {
+		t.Fatalf("image retransmitted: %d", len(again))
+	}
+}
+
+func TestViewImageWithoutKittySupportShowsNoPreview(t *testing.T) {
+	withKittySupport(t, false)
+	uri := testImageDataURI(t, 60, 40)
+	out := Tool(tool("view_image", map[string]any{"path": "/tmp/shot.png"}, uri, "completed"))
+	if !strings.Contains(out, "✓") {
+		t.Fatalf("expected success check:\n%s", out)
+	}
+	if strings.ContainsRune(out, 0x10eeee) {
+		t.Fatal("placeholder cells must not render without kitty graphics support")
+	}
+	if len(DrainImageTransmissions()) != 0 {
+		t.Fatal("no transmissions expected without kitty graphics support")
+	}
+}
+
+func TestExtractImageDataURI(t *testing.T) {
+	uri := testImageDataURI(t, 8, 8)
+	if mime, payload := extractImageDataURI(uri); mime != "png" || payload == "" {
+		t.Fatal("raw data URI should extract")
+	}
+	if mime, _ := extractImageDataURI(map[string]any{"image_url": uri}); mime != "png" {
+		t.Fatal("structured result should extract")
+	}
+	if mime, _ := extractImageDataURI("data:image/png;base64,short"); mime != "" {
+		t.Fatal("tiny payload must be rejected")
+	}
+}
+
+func TestKittyPlaceholderGrid(t *testing.T) {
+	p := kittyPlacement{id: 3, cols: 4, rows: 2}
+	out := kittyPlaceholder(p)
+	lines := strings.Split(out, "\n")
+	if len(lines) != 2 {
+		t.Fatalf("expected 2 rows, got %d", len(lines))
+	}
+	if got := strings.Count(out, string(rune(0x10eeee))); got != 8 {
+		t.Fatalf("expected 8 placeholder cells, got %d", got)
+	}
+	if !strings.Contains(out, "\x1b[38;2;0;0;3m") {
+		t.Fatalf("placeholder must carry the image id in the foreground color:\n%q", out)
+	}
+}
@@ -0,0 +1,103 @@
+package render
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/charmbracelet/x/ansi"
+)
+
+func TestHighlightCodeColorsKnownLanguage(t *testing.T) {
+	out := HighlightCode("def main():\n    return 1", "python")
+	if !strings.Contains(out, "\x1b[") {
+		t.Fatal("python code was not colorized")
+	}
+	if ansi.Strip(out) != "def main():\n    return 1" {
+		t.Fatalf("highlighting changed the code text: %q", ansi.Strip(out))
+	}
+}
+
+func TestMarkdownCodeFenceIsHighlighted(t *testing.T) {
+	out := renderAssistantMarkdown("intro\n```python\nimport os\n```\ndone")
+	plain := ansi.Strip(out)
+	if !strings.Contains(plain, "import os") {
+		t.Fatalf("code fence content missing: %q", plain)
+	}
+	if strings.Contains(plain, "```") {
+		t.Fatalf("fence markers leaked into output: %q", plain)
+	}
+}
+
+func TestParseFencedCode(t *testing.T) {
+	lang, code := ParseFencedCode("```python\nprint(1)\n```")
+	if lang != "python" || code != "print(1)" {
+		t.Fatalf("got lang=%q code=%q", lang, code)
+	}
+	lang, code = ParseFencedCode("plain text")
+	if lang != "" || code != "plain text" {
+		t.Fatalf("unfenced text mangled: lang=%q code=%q", lang, code)
+	}
+}
+
+func TestMarkdownTableIsAligned(t *testing.T) {
+	out := renderAssistantMarkdown(strings.Join([]string{
+		"| Name | Severity |",
+		"| --- | --- |",
+		"| SQLi | **high** |",
+		"| XSS | low |",
+	}, "\n"))
+	plain := ansi.Strip(out)
+	lines := strings.Split(plain, "\n")
+	if len(lines) != 4 {
+		t.Fatalf("expected 4 table rows, got %d: %q", len(lines), plain)
+	}
+	if !strings.Contains(lines[0], "Name") || !strings.Contains(lines[0], "│") {
+		t.Fatalf("header row not formatted: %q", lines[0])
+	}
+	if !strings.Contains(lines[1], "─┼─") {
+		t.Fatalf("separator rule missing: %q", lines[1])
+	}
+	if !strings.Contains(lines[2], "high") || strings.Contains(lines[2], "**") {
+		t.Fatalf("body cell not inline-formatted: %q", lines[2])
+	}
+	if strings.Index(lines[2], "│") != strings.Index(lines[3], "│") {
+		t.Fatalf("columns misaligned:\n%q\n%q", lines[2], lines[3])
+	}
+}
+
+func TestNonTablePipeLinesAreLeftAlone(t *testing.T) {
+	out := renderAssistantMarkdown("a | b\nplain line")
+	if !strings.Contains(ansi.Strip(out), "a | b") {
+		t.Fatalf("pipe text mangled: %q", ansi.Strip(out))
+	}
+}
+
+func TestInlineFormatKeepsNonEmphasisMarkers(t *testing.T) {
+	literal := []string{
+		"ls *.py *.go",
+		"snake_case_name and other_var_here",
+		"a * b * c",
+		"call obj.__init__ now",
+		"rm -rf /tmp/* /var/*",
+		"5 * 3 = 15",
+	}
+	for _, line := range literal {
+		if got := ansi.Strip(inlineFormat(line)); got != line {
+			t.Fatalf("%q was treated as emphasis: %q", line, got)
+		}
+	}
+}
+
+func TestInlineFormatStillStylesRealEmphasis(t *testing.T) {
+	cases := map[string]string{
+		"this is *italic* text": "this is italic text",
+		"this is **bold** text": "this is bold text",
+		"gone ~~away~~ now":     "gone away now",
+		"use `code` here":       "use code here",
+	}
+	for line, want := range cases {
+		if got := ansi.Strip(inlineFormat(line)); got != want {
+			t.Fatalf("%q: got %q want %q", line, got, want)
+		}
+	}
+}
@@ -0,0 +1,111 @@
+package render
+
+import (
+	"strings"
+)
+
+// ---------------------------------------------------------------------------
+// Notes (notes_renderer.py)
+// ---------------------------------------------------------------------------
+
+func renderNote(name string, args map[string]any, result any) string {
+	var b strings.Builder
+	icon := Col(Gold).Render("◇ ")
+	switch name {
+	case "create_note":
+		category := StringValue(args["category"])
+		if category == "" {
+			category = "general"
+		}
+		title, content := strings.TrimSpace(StringValue(args["title"])), strings.TrimSpace(StringValue(args["content"]))
+		b.WriteString(icon + Dim().Render("note") + " " + Dim().Render("("+category+")"))
+		if title != "" {
+			b.WriteString("\n  " + title)
+		}
+		if content != "" {
+			b.WriteString("\n  " + Dim().Render(content))
+		}
+		if title == "" && content == "" {
+			b.WriteString("\n  " + Dim().Render("Capturing..."))
+		}
+	case "delete_note":
+		b.WriteString(icon + Dim().Render("note removed"))
+	case "update_note":
+		title, content := StringValue(args["title"]), strings.TrimSpace(StringValue(args["content"]))
+		b.WriteString(icon + Dim().Render("note updated"))
+		if title != "" {
+			b.WriteString("\n  " + title)
+		}
+		if content != "" {
+			b.WriteString("\n  " + Dim().Render(content))
+		}
+		if title == "" && content == "" {
+			b.WriteString("\n  " + Dim().Render("Updating..."))
+		}
+	case "list_notes":
+		b.WriteString(icon + Dim().Render("notes"))
+		b.WriteString(noteListBody(result))
+	case "get_note":
+		b.WriteString(icon + Dim().Render("note read"))
+		if m, ok := result.(map[string]any); ok && truthy(m["success"]) {
+			note, _ := m["note"].(map[string]any)
+			renderSingleNote(&b, note)
+		} else {
+			b.WriteString("\n  " + Dim().Render("Loading..."))
+		}
+	default:
+		b.WriteString(icon + Dim().Render(strings.ReplaceAll(name, "_", " ")))
+	}
+	return b.String()
+}
+
+func noteListBody(result any) string {
+	var b strings.Builder
+	if s, ok := result.(string); ok && strings.TrimSpace(s) != "" {
+		return "\n  " + Dim().Render(strings.TrimSpace(s))
+	}
+	m, ok := result.(map[string]any)
+	if !ok || !truthy(m["success"]) {
+		return "\n  " + Dim().Render("Loading...")
+	}
+	notes, _ := m["notes"].([]any)
+	count, _ := NumericValue(m["total_count"])
+	if int(count) == 0 || len(notes) == 0 {
+		return "\n  " + Dim().Render("No notes")
+	}
+	for _, n := range notes {
+		note, _ := n.(map[string]any)
+		title := strings.TrimSpace(StringValue(note["title"]))
+		if title == "" {
+			title = "(untitled)"
+		}
+		category := StringValue(note["category"])
+		if category == "" {
+			category = "general"
+		}
+		content := strings.TrimSpace(StringValue(note["content"]))
+		if content == "" {
+			content = strings.TrimSpace(StringValue(note["content_preview"]))
+		}
+		b.WriteString("\n  - " + title + Dim().Render(" ("+category+")"))
+		if content != "" {
+			b.WriteString("\n    " + Dim().Render(content))
+		}
+	}
+	return b.String()
+}
+
+func renderSingleNote(b *strings.Builder, note map[string]any) {
+	title := strings.TrimSpace(StringValue(note["title"]))
+	if title == "" {
+		title = "(untitled)"
+	}
+	category := StringValue(note["category"])
+	if category == "" {
+		category = "general"
+	}
+	b.WriteString("\n  " + title + Dim().Render(" ("+category+")"))
+	if content := strings.TrimSpace(StringValue(note["content"])); content != "" {
+		b.WriteString("\n  " + Dim().Render(content))
+	}
+}
--- a/Show More
+++ b/Show More